[chance-coleman]

Description

Add PrepareDeploySourceFromTarget so callers can prepare a bundle from an oras.ReadOnlyTarget and supply their own package layout loader. Preparation resolves the requested architecture and materializes the bundle HCL, defaults, and values without fetching package payloads. The returned source owns a temporary workspace that callers close after deployment.

Reuse bundle definition parsing and fetched HCL bytes to avoid duplicate registry reads. Target sources require a loader and do not support resume.

Related Issue

Fixes CLI-383

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Steps to Validate

• go test ./internal/artifact ./internal/oci ./pkg/bundle -count=1
• go test -tags=library ./tests/library/... -count=1 -timeout 5m
• Manually pushed a bundle to a local OCI registry and prepared it through a read-only target; checked defaults, values, loader behavior, and cleanup.
• Deployed through the target source into a fresh k3d cluster; verified the Helm release and ConfigMap, then removed the test cluster.

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide followed

[chance-coleman]

@codex @greptile review these changes

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T17:01:26.889068Z	0af6f19	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Adds PrepareDeploySourceFromTarget to prepare a bundle from an oras.ReadOnlyTarget with a caller-supplied package loader.

• Callers can prepare bundle deploy sources from read-only ORAS targets.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Read-only target and caller loader] --> B[Resolve architecture-specific bundle]
  B --> C[Read and parse bundle definition]
  C --> D[Write HCL, defaults, and values]
  D --> E[Return prepared source]
  E --> F[Deploy with caller loader]
  F --> G[Caller closes source]
  G --> H[Remove private workspace]

Loading

_{Reviews (2) · Last reviewed commit: "docs(bundle): simplify target source com..." · Reviewed by Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0af6f19977

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0af6f19977

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[slaskawi]

LGTM but would appreciate @Racer159's review on it

[Racer159]

nits