From 39a3e26548357e3a6055765e59a67f4322596f31 Mon Sep 17 00:00:00 2001
From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com>
Date: Sat, 5 Sep 2026 20:45:40 -0300
Subject: [PATCH] fix(agent): render the worker block with indent so long
 strings keep no newline

The template re-emitted yamlencode(worker) line by line, leaving an empty
line between every two lines. yamlencode folds strings longer than ~80
characters at a space, and inside a folded double-quoted scalar an empty
line is a literal newline, so a long patch command reached the chart split
in two without any plan or apply error. indent() keeps the block contiguous.
---
 .../nullplatform_agent_values.tmpl.yaml       |  4 +--
 .../agent/tests/agent_values.tftest.hcl       | 33 +++++++++++++++++++
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml b/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml
index 4785a44d..94d60c76 100644
--- a/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml
+++ b/nullplatform/agent/templates/nullplatform_agent_values.tmpl.yaml
@@ -36,7 +36,5 @@ initScripts:
   %{ endif }
 
 worker:
-  %{ for line in split("\n", yamlencode(worker)) }
-  ${line}
-  %{ endfor }
+  ${indent(2, yamlencode(worker))}
 
diff --git a/nullplatform/agent/tests/agent_values.tftest.hcl b/nullplatform/agent/tests/agent_values.tftest.hcl
index 038d0f35..beeb54dc 100644
--- a/nullplatform/agent/tests/agent_values.tftest.hcl
+++ b/nullplatform/agent/tests/agent_values.tftest.hcl
@@ -325,3 +325,36 @@ run "create_namespace_is_overridable" {
     error_message = "create_namespace must be overridable to false for stacks where another module already owns the namespace"
   }
 }
+
+# yamlencode folds strings longer than ~80 characters at a space, as YAML
+# allows. The values template used to re-emit the encoded block line by line,
+# leaving an empty line between every two lines; inside a folded string an
+# empty line is a literal newline, so a long patch command reached the chart
+# split in two. Decoding the rendered values must give the string back intact.
+run "long_worker_patch_strings_survive_rendering" {
+  command = plan
+
+  variables {
+    worker = {
+      patches = [{
+        target = { package = "scopes-lambda" }
+        merge = {
+          spec = {
+            containers = [{
+              name    = "worker"
+              command = ["sh", "-c", "wget -qO- https://github.com/nullplatform/scopes-networking/archive/refs/tags/v0.1.0.tar.gz | tar -xz --strip-components=1 -C /overrides"]
+            }]
+          }
+        }
+      }]
+    }
+  }
+
+  assert {
+    condition = anytrue([
+      for p in yamldecode(helm_release.agent.values[0]).worker.patches :
+      try(p.merge.spec.containers[0].command[2], "") == "wget -qO- https://github.com/nullplatform/scopes-networking/archive/refs/tags/v0.1.0.tar.gz | tar -xz --strip-components=1 -C /overrides"
+    ])
+    error_message = "a worker patch string longer than the yamlencode fold width must not pick up a newline when the values are rendered"
+  }
+}