[krishnankm]

Description of your changes

Fixes #257

This PR makes WorkflowRun reference validation more reliable.

The validating webhook now reads referenced Workflow resources directly from the API server instead of relying on the controller cache. This ensures that admission uses the current state of the referenced workflow.

The Helm chart now applies the configured webhook failure policy from the initial render. With the default Fail policy, a webhook or certificate failure will reject the request instead of silently admitting an invalid WorkflowRun.

The PR also corrects the validating webhook name and preserves the existing CA bundle during upgrades.

How has this code been tested

The tests cover:

• Rejection of CREATE requests with a missing workflowRef
• Rejection of UPDATE requests with a missing workflowRef
• Successful updates using an inline workflow
• Successful updates referencing a workflow in vela-system

The rendered webhook configuration was also checked to confirm that it uses failurePolicy: Fail and handles CREATE and UPDATE requests for WorkflowRun resources.

Special notes for your reviewer

The existing workflow lookup order is unchanged. A workflow in the WorkflowRun namespace still takes precedence, followed by the shared workflow in vela-system.

---

Summary by cubic

Enforces WorkflowRun reference validation by reading referenced Workflow resources directly from the API server, and fixes the validating webhook configuration so the failure policy and webhook name are applied correctly.

• Validation now uses an API reader instead of the controller cache, so admission reflects the current state of the referenced workflow.
• The Helm chart now renders the configured failurePolicy (default Fail) rather than hardcoding Ignore, and uses the corrected webhook name validating.core.oam.dev.v1alpha1.workflowruns.
• Upgrades preserve the existing CA bundle from the previously deployed webhook under either the new or legacy webhook name.
• CREATE and UPDATE requests are rejected when the referenced workflow cannot be resolved; the lookup order (workflow namespace first, then vela-system) is unchanged.

^{Written for commit 9d7a6c5. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.92%. Comparing base (d7db9c4) to head (9d7a6c5).
⚠️ Report is 25 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #258      +/-   ##
==========================================
+ Coverage   62.49%   69.92%   +7.43%     
==========================================
  Files          62       73      +11     
  Lines        4415     5845    +1430     
==========================================
+ Hits         2759     4087    +1328     
- Misses       1324     1366      +42     
- Partials      332      392      +60     

Flag	Coverage Δ
e2etests	24.73% <100.00%> (?)
unit-test	64.34% <50.00%> (+1.85%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.