Function loadValueFile

pkg/engine/engine.go:1678–1699

loadValueFile reads a single --values / templateOptions.valueFiles entry into a map. A file named *.encrypted.yaml is age-decrypted in memory with the project's talm.key (rootDir locates the key; no plaintext touches disk); any other file is read as plaintext YAML. Detection is name-authoritative an

(rootDir, filePath string)

// carries no envelope, so a mis-named or empty file fails loudly instead of
// slipping through as plaintext.
func loadValueFile(rootDir, filePath string) (map[string]any, error) {
	if strings.HasSuffix(filePath, age.EncryptedFileSuffix) {
		decrypted, err := age.DecryptYAMLToMap(rootDir, filePath)
		if err != nil {
			return nil, errors.Wrapf(err, "failed to load encrypted values file %s", filePath)
		}

		return decrypted, nil
	}

	buf, err := os.ReadFile(filePath)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to read values file %s", filePath)
	}

	currentMap := make(map[string]any)
	if err := yaml.Unmarshal(buf, &currentMap); err != nil {
		return nil, errors.Wrapf(err, "failed to unmarshal values from file %s", filePath)
	}

	return currentMap, nil
}

// Imported from Helm
// https://github.com/helm/helm/blob/c6beb169d26751efd8131a5d65abe75c81a334fb/pkg/cli/values/options.go#L44