[quality] chart: CronJob name exceeds the 52-character API limit for release names of 32+ characters; no test pins resource-name length

Start with the CronJob name in charts/prow-github-app/templates/cronjob.yaml line 5 and the fullname helper in templates/_helpers.tpl. Add a bounded cronjobName helper, use it in cronjob.yaml and in templates/NOTES.txt line 15, then add a long-release-name case in tests/naming_test.yaml and run helm-unittest. Done when the CronJob name stays within 52 characters for a 32+ character release name and existing short-named releases render unchanged. The issue says the template and NOTES edits need a maintainer to land.

Finding

charts/prow-github-app/templates/cronjob.yaml:5 names the CronJob {{ include "prow-github-app.fullname" . }}-jobs. fullname (_helpers.tpl:5-15) is only bounded by trunc 63, so the CronJob name can reach 68 characters. The API server rejects CronJob names longer than 52 characters (kubernetes/kubernetes pkg/apis/batch/validation/validation.go: "must be no more than 52 characters", because the controller appends an 11-character timestamp to each Job name), so helm install fails for any release name of 32 or more characters that does not already contain prow-github-app (Helm itself allows release names up to 53). Release names containing the chart name break at 48+.

Reproduced at main@19d23da with helm 4.0.0:

$ helm template platform-team-prow-automation-production-eu-west charts/prow-github-app -f charts/prow-github-app/tests/values/creds.yaml | grep -- '-jobs'
  name: platform-team-prow-automation-production-eu-west-prow-github-ap-jobs   # 68 chars
$ helm template abcdefghijklmnopqrstuvwxyz012345 charts/prow-github-app -f …/creds.yaml   # 32-char release
  name: abcdefghijklmnopqrstuvwxyz012345-prow-github-app-jobs                   # 53 chars → rejected

Nothing catches it today: helm lint does not check name lengths, the four helm-unittest suites (41 tests) never set a long release name, and the two kind installs in .github/workflows/test.yml (helm install single …, helm install ha …) use 6- and 2-character release names. Every other resource stays valid (the 63-char Service/Deployment/ConfigMap names are within the DNS label limit), so only the CronJob — i.e. the sweep/label-sync/tide scheduled jobs — is lost, and only at apply time.

Recommendation

Add a bounded name helper and use it from both places that print the CronJob name, then pin it with a long-release-name test.

charts/prow-github-app/templates/_helpers.tpl (append):

{{/* CronJob names are capped at 52 characters (63 less the 11-character Job timestamp suffix) */}}
{{- define "prow-github-app.cronjobName" -}}
{{- printf "%s-jobs" (include "prow-github-app.fullname" . | trunc 47 | trimSuffix "-") -}}
{{- end -}}

charts/prow-github-app/templates/cronjob.yaml:5:

  name: {{ include "prow-github-app.cronjobName" . }}

charts/prow-github-app/templates/NOTES.txt:15: replace {{ include "prow-github-app.fullname" . }}-jobs with {{ include "prow-github-app.cronjobName" . }} so the notes print the name that was actually created.

New suite charts/prow-github-app/tests/naming_test.yaml (fails on main with Actual: platform-team-prow-automation-production-eu-west-prow-github-ap-jobs, passes with the change above — verified locally, helm-unittest 1.2.1, 42/42):

suite: resource names
templates:
  - cronjob.yaml
values:
  - ./values/creds.yaml
tests:
  - it: a long release name keeps the CronJob name within the 52 characters the API server allows
    release:
      name: platform-team-prow-automation-production-eu-west
    template: cronjob.yaml
    asserts:
      - matchRegex: {path: metadata.name, pattern: '^[a-z0-9]([-a-z0-9]{0,50}[a-z0-9])?$'}
      - matchRegex: {path: metadata.name, pattern: '-jobs$'}

trunc 47 is the largest bound that leaves room for -jobs; trimSuffix "-" keeps the result a valid DNS label when the cut lands on a hyphen. The name is derived from fullname the same way for every render, so an upgrade of an existing short-named release is unaffected (names of 47 characters or fewer are unchanged).

The template and NOTES edits are production chart changes outside the quality lane's remit (tests only), and the pinning test cannot ship without them — it fails on main. This needs a human or a merge-tier agent to land all three files together.

• _helpers.tpl prow-github-app.cronjobName helper + cronjob.yaml:5 + NOTES.txt:15 use it
• tests/naming_test.yaml long-release-name case

Priority

• Impact: medium (install fails for ordinary descriptive release names; scheduled jobs are the only resource lost, and only at apply time)
• Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 19d23da

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88