feat: deno runtime for typescript by dmmordvi · Pull Request #565 · werf/nelm

dmmordvi · 2026-02-13T22:25:18Z

Summary by Bito

This pull request introduces Deno as a new runtime for TypeScript support in Helm charts, replacing the existing JavaScript runtime implementation based on goja and esbuild with a more secure and modern Deno-based approach that enables bundling and executing TypeScript code with controlled permissions.

Detailed Changes

Introduces pkg/deno package with DenoRuntime for secure TypeScript bundling and execution in Helm charts, implementing restricted permissions for file access.
Adds comprehensive internal/ts package with utilities for TypeScript file handling, initialization, rendering, and bundling operations.
Removes dependencies on goja, goja_nodejs, esbuild, sourcemap, and related libraries, replacing them with Deno for improved security and performance.
Updates chart commands to include new TypeScript-specific subcommands and flags for Deno binary path configuration and bundle rebuilding.
Modifies chart packing and linting processes to utilize the new Deno-based bundler instead of the previous runtime.
Adds extensive test coverage across multiple new files for TypeScript functionality, including rendering, bundling, and package management.

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

…ild`, `nelm chart pack` Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # cmd/nelm/groups.go # internal/chart/chart_render.go # internal/ts/bundle.go # internal/ts/files.go # internal/ts/init.go # pkg/common/common.go

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

…g + atomic mv Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # go.mod # go.sum

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

dmmordvi · 2026-02-27T18:26:05Z

/review

bito-code-review

Code Review Agent Run #5dfe02

Actionable Suggestions - 2

pkg/deno/downloader.go - 1
- Cleanup error logging missing · Line 42-44
pkg/deno/runtime.go - 1
- Stderr logged at wrong level · Line 167-171

Additional Suggestions - 2

pkg/deno/runtime.go - 1

Redundant comments on constants · Line 24-35

These comments merely repeat what the constant names already convey, violating the rule against obvious/redundant comments.

Code suggestion

 @@ -23,14 +23,8 @@
- const (
- 	// ChartTSBundleFile is the path to the bundle in a Helm chart.
- 	ChartTSBundleFile = ChartTSSourceDir + "dist/bundle.js"
- 	// ChartTSEntryPointJS is the JavaScript entry point path.
- 	ChartTSEntryPointJS = "src/index.js"
- 	// ChartTSEntryPointTS is the TypeScript entry point path.
- 	ChartTSEntryPointTS = "src/index.ts"
- 	// ChartTSSourceDir is the directory containing TypeScript sources in a Helm chart.
- 	ChartTSSourceDir = "ts/"
- 	// RenderInputFileName is the name of the input file with context for the Deno app.
- 	RenderInputFileName = "input.yaml"
- 	// RenderOutputFileName is the name of the output file with rendered manifests from the Deno app.
- 	RenderOutputFileName = "output.yaml"
- )
+ const (
+ 	ChartTSBundleFile = ChartTSSourceDir + "dist/bundle.js"
+ 	ChartTSEntryPointJS = "src/index.js"
+ 	ChartTSEntryPointTS = "src/index.ts"
+ 	ChartTSSourceDir = "ts/"
+ 	RenderInputFileName = "input.yaml"
+ 	RenderOutputFileName = "output.yaml"
+ )

go.sum - 1
- New External Dependency Added · Line 114-114
  
  New external dependency github.com/dustin/go-humanize v1.0.1 has been added as a direct dependency in go.mod. According to repository guidelines (AGENTS.md), new external dependencies must be flagged to the user first. Please confirm if this addition is intentional and necessary.

Review Details

Files reviewed - 34 · Commit Range: e6b3552..e17d511
- cmd/nelm/chart.go
- cmd/nelm/chart_lint.go
- cmd/nelm/chart_pack.go
- cmd/nelm/chart_render.go
- cmd/nelm/chart_ts.go
- cmd/nelm/chart_ts_build.go
- cmd/nelm/groups.go
- cmd/nelm/release_install.go
- cmd/nelm/release_plan_install.go
- go.mod
- go.sum
- internal/chart/chart_render.go
- internal/ts/bundle.go
- internal/ts/bundle_ai_test.go
- internal/ts/bundle_test.go
- internal/ts/esbuild.go
- internal/ts/export_test.go
- internal/ts/files.go
- internal/ts/init.go
- internal/ts/init_templates.go
- internal/ts/init_test.go
- internal/ts/package.go
- internal/ts/package_test.go
- internal/ts/render.go
- internal/ts/render_ai_test.go
- internal/ts/render_test.go
- internal/ts/runtime.go
- pkg/action/chart_lint.go
- pkg/action/chart_render.go
- pkg/action/chart_ts_build.go
- pkg/action/release_install.go
- pkg/action/release_plan_install.go
- pkg/deno/downloader.go
- pkg/deno/runtime.go
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- Golangci-lint (Linter) - ✔︎ Successful
- SNYK (Security Vulnerability) - ✔︎ Successful
- OWASP (Security Vulnerability) - ✔︎ Successful
- GOVULNCHECK (Security Vulnerability) - ✖︎ Failed

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by

internal/ts/downloader.go

internal/ts/deno.go

ilya-lesikov · 2026-03-05T08:36:30Z

cmd/nelm/chart_lint.go

 			return fmt.Errorf("add flag: %w", err)
 		}

+		if err := cli.AddFlag(cmd, &cfg.RebuildTSBundle, "rebuild-ts", false, "Rebuild the typescript bundle even if it already exists.", cli.AddFlagOptions{


Mention the limitations in the description. And maybe different flag name. How about --ignore-bundle-js? If our file is bundle.js (I don't remember) And make it cfg.IgnoreBundleJS. That we rebuild bundle under the hood if this option is true is implementation detail, the user shouldn't know it.

cmd/nelm/chart_ts_build.go

ilya-lesikov · 2026-03-05T09:43:56Z

cmd/nelm/chart_ts_build.go

+			return fmt.Errorf("add flag: %w", err)
+		}
+
+		if err := cli.AddFlag(cmd, &cfg.LogLevel, "log-level", string(log.InfoLevel), "Set log level. "+allowedLogLevelsHelp(), cli.AddFlagOptions{


Check which flags are present in any command. Even if not always used. At least tempdir flag is missing.

ilya-lesikov · 2026-03-05T09:59:10Z

cmd/nelm/chart_ts_init.go

-		"Initialize a new chart in the specified directory. If PATH is not specified, uses the current directory.",
-		10, // priority for ordering in help
-		chartCmdGroup,
+		"Initialize a new TypeScript chart.",


It's not a TS chart initialization, but an initialization of the TS directory in the existing Helm chart

Actually, we ensure chart structure too: we create Chart.yaml and values.yaml if it doesn't exist + we check .helmignore/.gitignore have necessary keys. Should we mention in cmd description that we ensure chart structure too?

Chart.yaml shouldn't be created. Alright, let's say it's not "an initialization of the TS directory", but "an initialization of files needed to render manifests via TS" or something. Write whatever, as long as the user don't think we would generate the chart from scratch.

cmd/nelm/chart_ts_init.go

ilya-lesikov · 2026-03-06T09:19:20Z

pkg/deno/runtime.go

+		if rt.rebuild && bundle != nil {
+			chart.RemoveRuntimeFile(ChartTSBundleFile)
+		}
+
+		chart.AddRuntimeFile(ChartTSBundleFile, bundleRes)


What will happen when rt.rebuild == false && bundle != nil? Do we get two bundles (old and new) in RuntimeFiles?

Theoretically it shouldn't because of this condition

nelm/pkg/deno/runtime.go

Line 59 in 30423bf

if bundle == nil || rt.rebuild {

.
But i will simplify condition to if bundle != nil {

Oh, alright, I see now

ilya-lesikov · 2026-03-06T09:47:07Z

pkg/deno/downloader.go

+	}
+
+	defer func() {
+		_ = denoFile.Close()


ilya-lesikov · 2026-03-06T09:49:43Z

pkg/deno/downloader.go

+		_ = fileReader.Close()
+	}()
+
+	limitReader := io.LimitReader(fileReader, 200*1024*1024)


I don't think we need this limiter here. Let's not overcomplicate. If its more than 200mb for whatever reason why should we care really

ilya-lesikov · 2026-03-06T09:52:09Z

pkg/deno/runtime.go

+const (
+	// ChartTSBundleFile is the path to the bundle in a Helm chart.
+	ChartTSBundleFile = ChartTSSourceDir + "dist/bundle.js"
+	// ChartTSEntryPointJS is the JavaScript entry point path.
+	ChartTSEntryPointJS = "src/index.js"
+	// ChartTSEntryPointTS is the TypeScript entry point path.
+	ChartTSEntryPointTS = "src/index.ts"
+	// ChartTSSourceDir is the directory containing TypeScript sources in a Helm chart.
+	ChartTSSourceDir = "ts/"
+	// RenderInputFileName is the name of the input file with context for the Deno app.
+	RenderInputFileName = "input.yaml"
+	// RenderOutputFileName is the name of the output file with rendered manifests from the Deno app.
+	RenderOutputFileName = "output.yaml"
+)


I'd say let's move these constants into pkg/common, they might be useful in different contexts without any logic of this package.

ilya-lesikov · 2026-03-06T10:00:05Z

pkg/deno/runtime.go

+	}
+
+	if bundle == nil || rt.rebuild {
+		if err := rt.ensureBinary(ctx); err != nil {


we are ensuring binary every time we recurse into a chart, but really only need to do it once. Maybe we better do downloading/caching outside of denoruntime? All we need is to go through Chart{}'s recursively and check if they have ts dir? And if there is one then download the thing to cache (unless custom path is specified)

Frankly, I don't think we need DenoRuntime class in here. Just make a few functions out of it, one will download binary, the other one will build bundle.js-es, the third one will run the bundles. There is no state to share so we don't need any classes for now

I used DenoRuntime class only because of 3p-helm... It is simpler to pass it like class and run BundleChartsRecursive in chart pack, and everything will work under the hood (check ts dir, download deno, bundle and add files into RuntimeFiles)

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

…ve/ensureDeno, disabled rule for decompress bomb Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # cmd/nelm/chart_pack.go # go.mod # go.sum # internal/ts/bundle.go # internal/ts/bundle_ai_test.go # internal/ts/files.go # internal/ts/render_ai_test.go # internal/ts/render_test.go

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

…for ts initialization Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

kitsunoff · 2026-03-14T00:38:02Z

Hey

I have a question

What wrong with goja runtime and why required to use a full sized runtime like Deno?

dmmordvi · 2026-03-16T10:51:12Z

Hi @kitsunoff

We have an idea to provide users with the flexibility to use standard ecosystem packages such as @kubernetes/client-node, cdk8s, and kubernetes-models.

Trying to use goja, we found a critical limitation: it lacks support for Node.js native APIs. Since many vital Kubernetes-related npm packages rely on these built-ins under the hood, they simply will not work in a goja_nodejs environment.

Choosing goja would result in a poor dev experience, because users will have a lot of restrictions (e.g., inability to use packages with Node dependencies or requiring external build steps for TypeScript). Deno, with its Node.js compatibility layer and native TypeScript execution, resolves these limitations.

dmmordvi added 20 commits February 14, 2026 01:23

feat: deno runtime for typescript

e6b3552

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: chart ts init / chart ts build, changes for ts init

d8f4d76

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: fixes for init ts test

deb9960

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: deno task build in deno.json

ced72e2

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: missing import

38f495b

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: deno bundle implementation

0cde3ee

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Merge branch 'main' into feat/typescript-deno

46ba3e4

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: format fix

2f26171

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: helm ignore node_modules

238a355

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: move deno bundle logic to 3p-helm, draft for `nelm chart ts bu…

0422508

…ild`, `nelm chart pack` Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

feat: fixes for ts build

d795632

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: ChartName for ts init (from werf)

13102ea

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Merge branch 'main' into feat/typescript-deno

cb061b4

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # cmd/nelm/groups.go # internal/chart/chart_render.go # internal/ts/bundle.go # internal/ts/files.go # internal/ts/init.go # pkg/common/common.go

wip: apply wormatter

b21d3a7

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: write context as input.yaml into temp dir and pass to deno run

7c13ab2

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: test fixes for ts/init

92a0580

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: tree folder structure for typescript render

83406cf

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: DenoRuntime class + binary downloader with double-checked lockin…

28db0c4

…g + atomic mv Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Merge branch 'main' into feat/typescript-deno

e928058

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # go.mod # go.sum

wip: updated 3p-helm version

5c339a9

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

dmmordvi marked this pull request as ready for review February 26, 2026 20:45

dmmordvi added 4 commits February 26, 2026 23:45

wip: fixes for logging

1b95a3c

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: changed naming for ts package from 3p-helm

8b3dec7

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: --rebuild-ts and --deno-bin-path flags

30423bf

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Merge branch 'main' into feat/typescript-deno

e17d511

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

bito-code-review bot reviewed Feb 27, 2026

View reviewed changes

internal/ts/downloader.go Show resolved Hide resolved

internal/ts/deno.go Show resolved Hide resolved

ilya-lesikov requested changes Mar 6, 2026

View reviewed changes

dmmordvi added 2 commits March 6, 2026 19:22

fix: review recommendations fixes

ef3ce5f

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Merge branch 'main' into feat/typescript-deno

caca802

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

dmmordvi added 4 commits March 6, 2026 23:23

fix: changed ts rebuild flag

bf3aeab

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

fix: changes for chart ts init, small refactor for BundleChartRecursi…

2a5a401

…ve/ensureDeno, disabled rule for decompress bomb Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

fix: format fixes

9bbdee1

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Merge branch 'main' into feat/typescript-deno

dd2dcb2

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

dmmordvi requested a review from ilya-lesikov March 10, 2026 17:53

dmmordvi mentioned this pull request Mar 10, 2026

fix: print engine.Render() result on debug level #570

Merged

dmmordvi added 8 commits March 11, 2026 22:13

fix: changed comment for InitChartStructure

920e4b9

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

fix: moved changes from 3p-helm

de00522

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

refactor: use separate functions instead of DenoRuntime class

1cf3d0e

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: updated version of npm package for init ts, changed description …

fa7d4bd

…for ts initialization Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: changed the way to pass DenoBinaryPath

c8b7f0a

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

wip: changed the way to pass DenoBinaryPath

7064989

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Merge branch 'main' into feat/typescript-deno

4230257

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Conversation

dmmordvi commented Feb 13, 2026 • edited by ilya-lesikov Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Bito

Uh oh!

dmmordvi commented Feb 27, 2026

Uh oh!

bito-code-review bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Code Review Agent Run #5dfe02

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dmmordvi Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kitsunoff commented Mar 14, 2026

Uh oh!

dmmordvi commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dmmordvi commented Feb 13, 2026 •

edited by ilya-lesikov

Loading

bito-code-review bot left a comment •

edited

Loading

dmmordvi Mar 6, 2026 •

edited

Loading

dmmordvi commented Mar 16, 2026 •

edited

Loading