Support Helm semver encoding in OCI repositories

internal/controller/ocirepository_controller.go

@@ -898,7 +898,11 @@ func (r *OCIRepositoryReconciler) getTagBySemver(repo name.Repository, exp strin
 
 	var matchingVersions []*semver.Version
 	for _, t := range validTags {
-		v, err := version.ParseVersion(t)
+		// Helm translates `+` to `_` in OCI tags, because `+` is not a valid tag character.
+		versionStr := strings.Replace(t, "_", "+", 1)
+		// It would be even better to use `org.opencontainers.image.version` annotation
+		// if present, but that adds a fetch for each tag.
+		v, err := version.ParseVersion(versionStr)
 		if err != nil {
 			continue
 		}
@@ -913,7 +917,8 @@ func (r *OCIRepositoryReconciler) getTagBySemver(repo name.Repository, exp strin
 	}
 
 	sort.Sort(sort.Reverse(semver.Collection(matchingVersions)))
-	return repo.Tag(matchingVersions[0].Original()), nil
+	asTag := strings.Replace(matchingVersions[0].Original(), "+", "_", 1)
+	return repo.Tag(asTag), nil
 }
 
 // keychain generates the credential keychain based on the resource

internal/controller/ocirepository_controller_test.go

@@ -2866,6 +2866,7 @@ func TestOCIRepository_getArtifactRef(t *testing.T) {
 		"6.1.5",
 		"6.1.6-rc.1",
 		"6.1.6",
+		"6.1.7_ref.1234567", // Version 6.1.7+ref.1234567, encoded as a tag
 	)
 	g.Expect(err).ToNot(HaveOccurred())
 
@@ -2898,12 +2899,12 @@ func TestOCIRepository_getArtifactRef(t *testing.T) {
 			want: "ghcr.io/stefanprodan/charts@" + imgs["6.1.6"].digest.String(),
 		},
 		{
-			name: "valid url with semver reference",
+			name: "valid url with semver reference and build identifier",
 			url:  fmt.Sprintf("oci://%s/podinfo", server.registryHost),
 			reference: &sourcev1.OCIRepositoryRef{
 				SemVer: ">= 6.1.6",
 			},
-			want: server.registryHost + "/podinfo:6.1.6",
+			want: server.registryHost + "/podinfo:6.1.7_ref.1234567",
 		},
 		{
 			name:    "invalid url without oci prefix",