feat: add undeploy.sh script to Helm bundle deployer (#91)

Author: mchmarny

pkg/bundler/deployer/helm/helm.go

@@ -42,6 +42,9 @@ var componentReadmeTemplate string
 //go:embed templates/deploy.sh.tmpl
 var deployScriptTemplate string
 
+//go:embed templates/undeploy.sh.tmpl
+var undeployScriptTemplate string
+
 // criteriaAny is the wildcard value for criteria fields.
 const criteriaAny = "any"
 
@@ -151,6 +154,15 @@ func (g *Generator) Generate(ctx context.Context, input *GeneratorInput, outputD
 	output.Files = append(output.Files, deployPath)
 	output.TotalSize += deploySize
 
+	// Generate undeploy.sh
+	undeployPath, undeploySize, err := g.generateUndeployScript(ctx, input, components, outputDir)
+	if err != nil {
+		return nil, errors.Wrap(errors.ErrCodeInternal,
+			"failed to generate undeploy.sh", err)
+	}
+	output.Files = append(output.Files, undeployPath)
+	output.TotalSize += undeploySize
+
 	// Generate checksums.txt if requested
 	if input.IncludeChecksums {
 		if err := checksum.GenerateChecksums(ctx, outputDir, output.Files); err != nil {
@@ -425,6 +437,39 @@ func (g *Generator) generateDeployScript(ctx context.Context, input *GeneratorIn
 	return deployPath, deploySize, nil
 }
 
+// generateUndeployScript creates the undeploy.sh automation script.
+func (g *Generator) generateUndeployScript(ctx context.Context, input *GeneratorInput, components []ComponentData, outputDir string) (string, int64, error) {
+	if err := ctx.Err(); err != nil {
+		return "", 0, err
+	}
+
+	// Build reversed component list for uninstall order
+	reversed := make([]ComponentData, len(components))
+	for i, comp := range components {
+		reversed[len(components)-1-i] = comp
+	}
+
+	data := struct {
+		BundlerVersion     string
+		ComponentsReversed []ComponentData
+	}{
+		BundlerVersion:     input.Version,
+		ComponentsReversed: reversed,
+	}
+
+	undeployPath, undeploySize, err := g.generateFromTemplate(undeployScriptTemplate, data, outputDir, "undeploy.sh")
+	if err != nil {
+		return "", 0, err
+	}
+
+	// Make executable
+	if err := os.Chmod(undeployPath, 0755); err != nil {
+		return "", 0, errors.Wrap(errors.ErrCodeInternal, "failed to set undeploy.sh permissions", err)
+	}
+
+	return undeployPath, undeploySize, nil
+}
+
 // generateFromTemplate renders a template and writes it to baseDir/filename.
 // It uses safeJoin to verify the output path stays within baseDir.
 func (g *Generator) generateFromTemplate(tmplContent string, data any, baseDir, filename string) (string, int64, error) {

pkg/bundler/deployer/helm/helm_test.go

@@ -57,7 +57,7 @@ func TestGenerate_Success(t *testing.T) {
 	}
 
 	// Verify root files exist
-	rootFiles := []string{"README.md", "deploy.sh"}
+	rootFiles := []string{"README.md", "deploy.sh", "undeploy.sh"}
 	for _, f := range rootFiles {
 		path := filepath.Join(outputDir, f)
 		if _, statErr := os.Stat(path); os.IsNotExist(statErr) {
@@ -101,9 +101,9 @@ func TestGenerate_Success(t *testing.T) {
 		t.Error("Chart.yaml should not exist in per-component bundle")
 	}
 
-	// Verify output has reasonable file count (2 root files + 2 component dirs × 2 files each = 6)
-	if len(output.Files) < 6 {
-		t.Errorf("expected at least 6 files, got %d", len(output.Files))
+	// Verify output has reasonable file count (3 root files + 2 component dirs × 2 files each = 7)
+	if len(output.Files) < 7 {
+		t.Errorf("expected at least 7 files, got %d", len(output.Files))
 	}
 }
 
@@ -187,6 +187,9 @@ func TestGenerate_WithChecksums(t *testing.T) {
 	if !strings.Contains(content, "deploy.sh") {
 		t.Error("checksums.txt missing deploy.sh")
 	}
+	if !strings.Contains(content, "undeploy.sh") {
+		t.Error("checksums.txt missing undeploy.sh")
+	}
 	if !strings.Contains(content, filepath.Join("cert-manager", "values.yaml")) {
 		t.Error("checksums.txt missing cert-manager/values.yaml")
 	}
@@ -382,6 +385,65 @@ func TestGenerate_DeployScriptExecutable(t *testing.T) {
 	}
 }
 
+func TestGenerate_UndeployScriptExecutable(t *testing.T) {
+	g := NewGenerator()
+	ctx := context.Background()
+	outputDir := t.TempDir()
+
+	input := &GeneratorInput{
+		RecipeResult: createTestRecipeResult(),
+		ComponentValues: map[string]map[string]any{
+			"cert-manager": {},
+			"gpu-operator": {},
+		},
+		Version: "v1.0.0",
+	}
+
+	_, err := g.Generate(ctx, input, outputDir)
+	if err != nil {
+		t.Fatalf("Generate failed: %v", err)
+	}
+
+	undeployPath := filepath.Join(outputDir, "undeploy.sh")
+	info, statErr := os.Stat(undeployPath)
+	if os.IsNotExist(statErr) {
+		t.Fatal("undeploy.sh does not exist")
+	}
+
+	// Check executable permission (0755)
+	mode := info.Mode()
+	if mode&0111 == 0 {
+		t.Errorf("undeploy.sh is not executable, mode: %o", mode)
+	}
+
+	// Verify content
+	content, err := os.ReadFile(undeployPath)
+	if err != nil {
+		t.Fatalf("failed to read undeploy.sh: %v", err)
+	}
+	script := string(content)
+
+	if !strings.HasPrefix(script, "#!/usr/bin/env bash") {
+		t.Error("undeploy.sh missing shebang")
+	}
+	if !strings.Contains(script, "set -euo pipefail") {
+		t.Error("undeploy.sh missing strict mode")
+	}
+	if !strings.Contains(script, "helm uninstall") {
+		t.Error("undeploy.sh missing helm uninstall command")
+	}
+
+	// Verify reverse order: gpu-operator should appear before cert-manager
+	gpuIdx := strings.Index(script, "Uninstalling gpu-operator")
+	certIdx := strings.Index(script, "Uninstalling cert-manager")
+	if gpuIdx < 0 || certIdx < 0 {
+		t.Fatal("undeploy.sh missing component uninstall lines")
+	}
+	if gpuIdx > certIdx {
+		t.Error("undeploy.sh components not in reverse order: gpu-operator should come before cert-manager")
+	}
+}
+
 func TestNormalizeVersion(t *testing.T) {
 	tests := []struct {
 		input    string

pkg/bundler/deployer/helm/templates/undeploy.sh.tmpl

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Cloud Native Stack Undeployment Script
+# Generated by Eidos Bundler {{ .BundlerVersion }}
+#
+# Usage: ./undeploy.sh [--keep-namespaces]
+#   --keep-namespaces  Skip deleting namespaces after uninstalling components
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+KEEP_NS=false
+if [[ "${1:-}" == "--keep-namespaces" ]]; then
+  KEEP_NS=true
+fi
+
+echo "Undeploying Cloud Native Stack components..."
+
+# Uninstall components in reverse order
+{{ range .ComponentsReversed -}}
+{{ if .HasManifests -}}
+echo "Deleting manifests for {{ .Name }}..."
+kubectl delete -f "${SCRIPT_DIR}/{{ .Name }}/manifests/" --ignore-not-found
+{{ end -}}
+{{ if .HasChart -}}
+echo "Uninstalling {{ .Name }} ({{ .Namespace }})..."
+helm uninstall {{ .Name }} -n {{ .Namespace }} --ignore-not-found || true
+if [[ "${KEEP_NS}" == "false" ]] && kubectl get namespace {{ .Namespace }} &>/dev/null; then
+  echo "Deleting namespace {{ .Namespace }}..."
+  kubectl delete namespace {{ .Namespace }} --ignore-not-found
+fi
+{{ end -}}
+{{ end }}
+echo "Undeployment complete."