fix: report Helm lifecycle and reverse delete order

Author: shirkevich

docs/fixes/2026-07-31-native-helm-release-lifecycle.md

@@ -9,6 +9,11 @@ state. Caller cancellation propagates through direct and dependency-ordered
 execution into install and upgrade actions and into delete wait and hook phases;
 Helm 4 does not expose a context-aware uninstall request.
 
+Atmos reports the selected action and effective release policy before the Helm
+action begins, including any `hookOnly` to `watcher` promotion required by
+failure recovery. Bulk delete uses reverse dependency order so dependents are
+removed before the releases they consume.
+
 ## Migration notes
 
 - An omitted `release.timeout` remains `0s` (unbounded) for one minor release and emits a

docs/prd/native-helm-release-lifecycle.md

@@ -369,6 +369,7 @@ The following rules apply:
 - A release that fails and is successfully rolled back still returns failure to the scheduler.
 - A rollback or uninstall failure preserves the original release failure and adds the recovery failure.
 - Dependents never run after timeout, failed readiness, failed hooks, failed rollback, or cancellation.
+- Bulk delete traverses the selected graph in reverse topological order so dependents are removed before their dependencies.
 - A future mixed-kind scheduler consumes the same provider result; it must not reinterpret Helm readiness.
 
 ## Timeout Semantics

pkg/component/graph.go

@@ -37,6 +37,7 @@ type GraphExecutionOptions struct {
 	SubCommand    string
 	Flags         map[string]any
 	Selection     *GraphSelection
+	ReverseOrder  bool
 }
 
 // GraphNodeSkipObserver is implemented by providers that need to record graph
@@ -65,7 +66,11 @@ func ExecuteGraph(ctx context.Context, opts *GraphExecutionOptions) error {
 		return nil
 	}
 
-	log.Info("Processing components in dependency order", "component_type", opts.ComponentType, "count", len(order))
+	orderName := "dependency"
+	if opts.ReverseOrder {
+		orderName = "reverse_dependency"
+	}
+	log.Info("Processing components", "component_type", opts.ComponentType, "order", orderName, "count", len(order))
 	for i := range order {
 		select {
 		case <-ctx.Done():
@@ -127,9 +132,18 @@ func prepareExecutionOrder(opts *GraphExecutionOptions) (dependency.ExecutionOrd
 	if err != nil {
 		return nil, fmt.Errorf("%w: %w", errUtils.ErrTopologicalOrder, err)
 	}
+	if opts.ReverseOrder {
+		reverseExecutionOrder(order)
+	}
 	return order, nil
 }
 
+func reverseExecutionOrder(order dependency.ExecutionOrder) {
+	for left, right := 0, len(order)-1; left < right; left, right = left+1, right-1 {
+		order[left], order[right] = order[right], order[left]
+	}
+}
+
 // executeGraphNode executes a single graph node through the component provider.
 func executeGraphNode(ctx context.Context, opts *GraphExecutionOptions, node *dependency.Node) error {
 	nodeInfo := *opts.Info

pkg/component/graph_test.go

@@ -164,6 +164,23 @@ func TestExecuteGraphRunsComponentsInDependencyOrder(t *testing.T) {
 	}
 }
 
+func TestExecuteGraphRunsDeleteInReverseDependencyOrder(t *testing.T) {
+	provider := &graphTestProvider{}
+	err := ExecuteGraph(context.Background(), &GraphExecutionOptions{
+		Provider:      provider,
+		Info:          &schema.ConfigAndStacksInfo{},
+		Stacks:        graphTestStacks(),
+		ComponentType: cfg.KubernetesComponentType,
+		SubCommand:    "delete",
+		ReverseOrder:  true,
+	})
+
+	require.NoError(t, err)
+	require.Len(t, provider.calls, 4)
+	assertLessCallIndex(t, provider.calls, "api", "dev", "base", "dev")
+	assertLessCallIndex(t, provider.calls, "worker", "dev", "base", "prod")
+}
+
 func TestExecuteGraphNodeDoesNotRedispatchBulkSelection(t *testing.T) {
 	provider := &graphTestProvider{}
 	info := &schema.ConfigAndStacksInfo{

pkg/component/helm/client.go

@@ -85,6 +85,7 @@ func applyRelease(ctx context.Context, spec *chartSpec, dryRun bool) (releaseAct
 			return releaseActionResult{Operation: releaseOperationInstall}, resolveErr
 		}
 		spec.Lifecycle = lifecycle
+		reportResolvedLifecycle(lifecycle)
 		operationCtx, cancel := releaseOperationContext(ctx, lifecycle.Policy.Timeout)
 		defer cancel()
 		manifest, installErr := installRelease(operationCtx, actx, spec, dryRun)
@@ -97,6 +98,7 @@ func applyRelease(ctx context.Context, spec *chartSpec, dryRun bool) (releaseAct
 		return releaseActionResult{Operation: releaseOperationUpgrade}, resolveErr
 	}
 	spec.Lifecycle = lifecycle
+	reportResolvedLifecycle(lifecycle)
 	operationCtx, cancel := releaseOperationContext(ctx, lifecycle.Policy.Timeout)
 	defer cancel()
 	manifest, upgradeErr := upgradeRelease(operationCtx, actx, spec, dryRun)

pkg/component/helm/client_lifecycle_test.go

@@ -212,7 +212,7 @@ func TestReleaseOperationContextPreservesZeroTimeout(t *testing.T) {
 	ctx, cancel := releaseOperationContext(parent, 0)
 	defer cancel()
 
-	assert.Same(t, parent, ctx)
+	assert.Equal(t, parent, ctx)
 	_, hasDeadline := ctx.Deadline()
 	assert.False(t, hasDeadline)
 }

pkg/component/helm/executor.go

@@ -179,7 +179,7 @@ func runWithHooks(
 		if err != nil {
 			return err
 		}
-		emitLifecycleWarnings(spec.Lifecycle.Warnings)
+		reportResolvedLifecycle(spec.Lifecycle)
 	}
 	if err := ctx.GoContext().Err(); err != nil {
 		return err
@@ -251,6 +251,27 @@ func emitLifecycleWarnings(warnings []lifecycleWarning) {
 	}
 }
 
+func reportResolvedLifecycle(resolution releaseLifecycleResolution) {
+	emitLifecycleWarnings(resolution.Warnings)
+	reason := "configured"
+	for _, warning := range resolution.Warnings {
+		if warning.Code == warningWaitDerived {
+			reason = warning.Message
+			break
+		}
+	}
+	policy := resolution.Policy
+	log.Debug("Resolved Helm release lifecycle",
+		"operation", policy.Operation,
+		"wait_strategy", policy.WaitStrategy,
+		"wait_strategy_reason", reason,
+		"wait_jobs", policy.WaitForJobs,
+		"on_failure", policy.OnFailure,
+		"timeout", policy.Timeout,
+		"timeout_field", resolution.TimeoutField,
+	)
+}
+
 // runTemplate renders the chart and writes the manifests per the render options.
 func runTemplate(ctx *component.ExecutionContext, atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo, spec *chartSpec) ([]*unstructured.Unstructured, error) {
 	objects, err := renderObjects(ctx.GoContext(), spec)

pkg/component/helm/executor_bulk.go

@@ -58,6 +58,7 @@ func executeBulk(
 		SubCommand:    command,
 		Flags:         ctx.Flags,
 		Selection:     selection,
+		ReverseOrder:  operation == OperationDelete,
 	})
 	if collector != nil {
 		runHelmAggregateCIHook(ctx, atmosConfig, info, collector.resultSet(), graphErr)

pkg/component/helm/executor_test.go

@@ -190,6 +190,16 @@ func TestExecuteBulkInitializesConfigAndGraph(t *testing.T) {
 	assert.Equal(t, cfg.HelmComponentType, graphOpts.ComponentType)
 	assert.Equal(t, "template", graphOpts.SubCommand)
 	assert.Equal(t, ctx.Flags, graphOpts.Flags)
+	assert.False(t, graphOpts.ReverseOrder)
+
+	graphOpts = nil
+	require.NoError(t, executeBulk(ctx, &schema.AtmosConfiguration{}, &schema.ConfigAndStacksInfo{
+		All:        true,
+		Stack:      "dev",
+		SubCommand: "delete",
+	}, OperationDelete))
+	require.NotNil(t, graphOpts)
+	assert.True(t, graphOpts.ReverseOrder)
 }
 
 func TestExecuteSingleSkipsDisabledComponent(t *testing.T) {

pkg/component/helm/lifecycle.go

@@ -325,6 +325,21 @@ func decodeDeletePolicy(releaseMap map[string]any) (deletePolicyInput, error) {
 }
 
 func resolveReleaseLifecycle(input releasePolicyInput, operation string, emitMigrationWarning bool) (releaseLifecycleResolution, error) {
+	resolution, err := resolveReleaseLifecycleBase(input, operation, emitMigrationWarning)
+	if err != nil {
+		return releaseLifecycleResolution{}, err
+	}
+	if err := validateAndDeriveLifecycle(&resolution); err != nil {
+		return releaseLifecycleResolution{}, err
+	}
+	return resolution, nil
+}
+
+// resolveReleaseLifecycleBase applies configuration precedence without deriving
+// cross-field values. Callers that overlay CLI flags must do so before the
+// single validateAndDeriveLifecycle pass, otherwise a derived watcher strategy
+// loses both its source hookOnly value and the explanation for the promotion.
+func resolveReleaseLifecycleBase(input releasePolicyInput, operation string, emitMigrationWarning bool) (releaseLifecycleResolution, error) {
 	resolution := releaseLifecycleResolution{
 		Policy:       defaultReleasePolicy(operation),
 		TimeoutField: "built-in default",
@@ -359,9 +374,6 @@ func resolveReleaseLifecycle(input releasePolicyInput, operation string, emitMig
 			Message: "helm release timeout is omitted; this release preserves 0s, but the default will become 5m in the next minor release",
 		})
 	}
-	if err := validateAndDeriveLifecycle(&resolution); err != nil {
-		return releaseLifecycleResolution{}, err
-	}
 	return resolution, nil
 }
 
@@ -448,7 +460,7 @@ func validateAndDeriveLifecycle(resolution *releaseLifecycleResolution) error {
 // resolveReleaseLifecycleWithFlags resolves configuration for the selected
 // action, then overlays only explicitly supplied CLI values at highest priority.
 func resolveReleaseLifecycleWithFlags(input releasePolicyInput, operation string, flags map[string]any) (releaseLifecycleResolution, error) {
-	resolution, err := resolveReleaseLifecycle(input, operation, true)
+	resolution, err := resolveReleaseLifecycleBase(input, operation, true)
 	if err != nil {
 		return releaseLifecycleResolution{}, err
 	}
@@ -502,7 +514,6 @@ func resolveReleaseLifecycleWithFlags(input releasePolicyInput, operation string
 		resolution.Policy.CleanupOnFailure = value
 	}
 
-	resolution.Warnings = removeLifecycleWarning(resolution.Warnings, warningWaitDerived)
 	if err := validateAndDeriveLifecycle(&resolution); err != nil {
 		return releaseLifecycleResolution{}, err
 	}