From f8f524b94fde7194d8968df4b07065342bd654ba Mon Sep 17 00:00:00 2001
From: MeepMr <67143880+MeepMr@users.noreply.github.com>
Date: Wed, 16 Sep 2026 16:43:34 +0200
Subject: [PATCH] probe: force IPv4 for the Helm download, then measure what
 was actually asked

Confirms the diagnosis and unblocks the measurement in one step. Not a
proposed fix - PR #253 is untouched. freesailarr is back in the matrix so
questions 1-3 can be answered: does k3s come up, how long does it take,
and does the hardest chart in the repo run with a real tunnel.
---
 .github/workflows/validate-charts.yml | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/validate-charts.yml b/.github/workflows/validate-charts.yml
index 010b0eb..1e768ad 100644
--- a/.github/workflows/validate-charts.yml
+++ b/.github/workflows/validate-charts.yml
@@ -309,10 +309,20 @@ jobs:
           docker info 2>&1 | grep -iE "rootless|WARNING" || echo "(no rootless/WARNING lines)"
           echo "### done - this step never fails on purpose"
           exit 0
-      - name: "Install Helm"
-        uses: azure/setup-helm@v5
-        with:
-          version: v3.18.4
+      # PROBE ONLY - this is NOT a proposed fix and is not in PR #253.
+      # azure/setup-helm downloads from get.helm.sh, which in this cluster
+      # resolves to an IPv6 Azure Front Door address (2603:1061:14:67::1) that
+      # never completes a TCP connect. curl -4 forces IPv4; if this succeeds it
+      # both unblocks the measurement and proves the diagnosis, because every
+      # other host in the probe resolved to IPv4 and answered in under a second.
+      - name: "Install Helm (PROBE: forced IPv4)"
+        run: |
+          curl -4 -sSfL -o /tmp/helm.tgz https://get.helm.sh/helm-v4.3.0-linux-amd64.tar.gz
+          tar -xzf /tmp/helm.tgz -C /tmp
+          mkdir -p "$HOME/.local/bin"
+          mv /tmp/linux-amd64/helm "$HOME/.local/bin/helm"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          "$HOME/.local/bin/helm" version
       # freesailarr is the one chart whose install-test needs credentials:
       # without a real Wireguard key gluetun never completes a handshake, and
       # behind its kill switch not a single app container becomes Ready. The key