Bug: azure/setup-helm@v4 Automatically Installing Helm v4.0.1 Causing Plugin Verification Failure

Start by reviewing the azure/setup-helm@v4 action configuration and the Helm installation path described in the workflow examples. Reproduce the plugin installation with Helm v4.0.1 and the helm-s3 command, then determine how version selection currently works. Done means Helm major-version behavior is explicit, compatible workflows no longer change unexpectedly, and the documentation explains the breaking change.

What happened?

Summary

Starting 25th November 2025, our GitHub Actions workflow began failing during Helm plugin installation. This happened because azure/setup-helm@v4 started installing Helm v4.0.1 instead of Helm 3.x versions that it consistently installed earlier. Helm v4 introduces mandatory plugin verification, which is not supported by several plugins including hypnoglow/helm-s3.

As a result, previously stable workflows started failing without any changes from our side.

Error Observed

Error: plugin source does not support verification. Use --verify=false to skip verification

This error occurs during the installation of the helm-s3 plugin when Helm v4.0.1 is used.

Expected Behavior

• The action should not silently upgrade major Helm versions.
• Helm v3 should continue to be installed unless explicitly configured otherwise.
• Major-breaking changes like Helm v4 should require explicit opt-in from the user.
• Documentation should clearly call out the impact of major version upgrades.

Actual Behavior

• azure/setup-helm@v4 automatically installs Helm v4.0.1.
• Helm v4 enforces plugin verification.
• Plugins that do not support verification (e.g., helm-s3) fail during installation.
• This caused previously working Helm workflows to break unexpectedly.

Impact

• Our workflow, unchanged for over a year, began failing suddenly.
• Using --verify=false is not acceptable due to internal security practices.
• This created avoidable operational disruption.

Actions Taken / Workaround

We replaced azure/setup-helm@v4 with a manual Helm installation script to ensure Helm v3 is used:

Earlier

- name: Install Helm
  uses: azure/setup-helm@v4

Current Step (workaround using Helm v3)

- name: Install Helm
  run: |
    curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
    chmod 700 get_helm.sh
    ./get_helm.sh
    echo "Installed Helm Version: $(helm version --template='{{.Version}}')"

This workaround installs Helm v3, and plugin installation works successfully.

Request

We kindly request the following:

1. Clarify whether switching to Helm v4 by default is intentional behavior for azure/setup-helm@v4.
2. Provide a mechanism to pin Helm major versions directly through the action.
3. Avoid major version upgrades without explicit user opt-in.
4. Update documentation to highlight breaking changes when Helm v4 is installed.

This will help avoid unexpected failures for users relying on Helm plugins that are not yet compatible with v4.

Version

• I am using the latest version

Runner

self-hosted and runner version: 2.329.0

Relevant log output

helm plugin install https://github.com/hypnoglow/helm-s3.git
Error: plugin source does not support verification. Use --verify=false to skip verification