fix: pointer-to-loop-var, finalizer predicate, nil dereference

Co-authored-by: moolen <1709030+moolen@users.noreply.github.com>

apis/externalsecrets/v1/conditions.go

@@ -18,9 +18,9 @@ package v1
 
 // GetExternalSecretCondition returns the condition with the provided type.
 func GetExternalSecretCondition(status ExternalSecretStatus, condType ExternalSecretConditionType) *ExternalSecretStatusCondition {
-	for _, c := range status.Conditions {
-		if c.Type == condType {
-			return &c
+	for i := range status.Conditions {
+		if status.Conditions[i].Type == condType {
+			return &status.Conditions[i]
 		}
 	}
 

apis/go.mod

@@ -3,6 +3,7 @@ module github.com/external-secrets/external-secrets/apis
 go 1.25.7
 
 require (
+	github.com/google/go-cmp v0.7.0
 	github.com/stretchr/testify v1.11.1
 	k8s.io/api v0.35.0
 	k8s.io/apiextensions-apiserver v0.35.0
@@ -35,7 +36,6 @@ require (
 	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kr/text v0.2.0 // indirect

pkg/controllers/externalsecret/externalsecret_controller.go

@@ -1337,6 +1337,10 @@ func shouldEnqueueExternalSecretUpdate(oldObj, newObj client.Object) bool {
 		return true
 	}
 
+	if !equality.Semantic.DeepEqual(oldES.GetFinalizers(), newES.GetFinalizers()) {
+		return true
+	}
+
 	oldDeletion := oldES.GetDeletionTimestamp()
 	newDeletion := newES.GetDeletionTimestamp()
 	if oldDeletion == nil && newDeletion == nil {

pkg/controllers/externalsecret/externalsecret_controller_test.go

@@ -1872,7 +1872,7 @@ var _ = Describe("ExternalSecret controller", Serial, func() {
 				}
 				// condition must now be true!
 				cond := esv1.GetExternalSecretCondition(es.Status, esv1.ExternalSecretReady)
-				if cond == nil && cond.Status != v1.ConditionTrue {
+				if cond == nil || cond.Status != v1.ConditionTrue {
 					return false
 				}
 				return true
@@ -2742,6 +2742,21 @@ var _ = Describe("ExternalSecret update predicate", func() {
 
 		Expect(shouldEnqueueExternalSecretUpdate(oldES, newES)).To(BeTrue())
 	})
+
+	It("should enqueue when finalizers change", func() {
+		oldES := &esv1.ExternalSecret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:       "foo",
+				Namespace:  "default",
+				Generation: 1,
+				Finalizers: []string{"external-secrets.io/finalizer"},
+			},
+		}
+		newES := oldES.DeepCopy()
+		newES.Finalizers = nil
+
+		Expect(shouldEnqueueExternalSecretUpdate(oldES, newES)).To(BeTrue())
+	})
 })
 
 var _ = Describe("ExternalSecret refresh policy", func() {