Fix incorrect handling when unfetched packages are deleted from upstream

[aravindtga]

Description

• What changed: When a subpackage deleted from upstream is in the unfetched state in origin (only contains a Kptfile), the update logic now fetches the full origin content at the correct commit SHA before performing the diff against local.
• Why it's needed: Previously, the diff between an unfetched origin (bare Kptfile) and local (full fetched content) always showed differences, so the subpackage was never deleted even when the user had made no local changes.
• How it works: The updatePackage function in pkg/lib/update/update.go detects the unfetched origin state via pkg.IsPackageUnfetched(), reads the commit SHA from the local upstreamLock, fetches origin at that exact commit using a new Commit field on fetch.Command, adds merge comments, and then performs the diff as before.

This PR is based on #2230, which was authored against the old codebase structure (when packages lived under internal/). That PR was never merged. These changes port the same approach to the current codebase (packages now under pkg/lib/) with adapted API signatures and additional test coverage.

Related Issue(s)

• Fixes kpt pkg update doesn't handle deletion of unfetched remote packages correctly. #2216

Type of Change

• Bug fix
• Refactor
• Tests

Checklist

• Code follows project style guidelines
• Self-reviewed changes
• Tests added/updated
• Documentation added/updated
• All tests and gating checks pass

AI Disclosure

• I have used AI in the creation of this PR.

If so, please describe how:
- Amazon Q Developer CLI to port and review the changes against the original PR #2230 and perform manual end-to-end testing and to draft the PR Message.

[netlify]

✅ Deploy Preview for kptdocs ready!

Name	Link
🔨 Latest commit	2318011
🔍 Latest deploy log	https://app.netlify.com/projects/kptdocs/deploys/6a7d9424eee15800085c9e06
😎 Deploy Preview	https://deploy-preview-4695--kptdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Fixes update behavior when upstream deletes a subpackage that is still “unfetched” (origin only has a Kptfile), by fetching origin content at the locked commit before diffing so unchanged subpackages can be deleted correctly.

Changes:

• Add support for fetching a package at a specific commit SHA via fetch.Command{Commit: ...}.
• Update cloning logic to use the provided commit (or resolved ref) and factor tag lookup into checkPackageTags.
• Add/update tests covering commit-pinned fetch and deletion of unfetched subpackages during update.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pkg/lib/util/fetch/fetch.go	Adds Commit support and refactors ref/tag resolution logic in the cloner.
pkg/lib/util/fetch/fetch_test.go	Adds a test that validates fetching a specific commit vs branch tip behavior.
pkg/lib/update/update.go	Fetches origin at the local upstream-lock commit when origin is unfetched before diffing deleted subpackages.
pkg/lib/update/update_test.go	Adds tests covering deletion/retention of unfetched subpackages based on local changes.
commands/pkg/update/cmdupdate_test.go	Adds CLI-level test coverage for unfetched subpackage deletion behavior and output.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.