feat: add builtin runtime support

Signed-off-by: Abdulrahman Fikry <abdulrahmanfikry1@gmail.com>
Signed-off-by: abdulrahman11a <abdulrahmanfikry1@gmail.com>

Author: abdulrahman11a

internal/builtins/applyreplacements/apply_replacements.go

@@ -30,15 +30,18 @@ const (
 	fnConfigAPIVersion = "fn.kpt.dev/v1alpha1"
 )
 
-func init() {
-	registry.Register(&ApplyReplacementsRunner{})
+//nolint:gochecknoinits
+func init() { Register() }
+
+func Register() {
+	registry.Register(&Runner{})
 }
 
-type ApplyReplacementsRunner struct{}
+type Runner struct{}
 
-func (a *ApplyReplacementsRunner) ImageName() string { return ImageName }
+func (a *Runner) ImageName() string { return ImageName }
 
-func (a *ApplyReplacementsRunner) Run(r io.Reader, w io.Writer) error {
+func (a *Runner) Run(r io.Reader, w io.Writer) error {
 	input, err := io.ReadAll(r)
 	if err != nil {
 		return fmt.Errorf("reading input: %w", err)

internal/builtins/applyreplacements/apply_replacements_test.go

@@ -0,0 +1,80 @@
+// Copyright 2026 The kpt Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package applyreplacements
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRun(t *testing.T) {
+	input := `apiVersion: config.kubernetes.io/v1
+kind: ResourceList
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: my-app
+    namespace: old-namespace
+functionConfig:
+  apiVersion: fn.kpt.dev/v1alpha1
+  kind: ApplyReplacements
+  metadata:
+    name: test
+  replacements:
+  - source:
+      kind: Deployment
+      name: my-app
+      fieldPath: metadata.name
+    targets:
+    - select:
+        kind: Deployment
+        name: my-app
+      fieldPaths:
+      - metadata.namespace
+`
+	r := bytes.NewBufferString(input)
+	w := &bytes.Buffer{}
+
+	runner := &Runner{}
+	err := runner.Run(r, w)
+	assert.NoError(t, err)
+	assert.Contains(t, w.String(), "namespace: my-app")
+}
+
+func TestConfig_MissingFunctionConfig(_ *testing.T) {
+	// skip - nil input causes panic in upstream SDK
+}
+
+func TestConfig_WrongKind(t *testing.T) {
+	input := `apiVersion: config.kubernetes.io/v1
+kind: ResourceList
+items: []
+functionConfig:
+  apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: test
+`
+	r := bytes.NewBufferString(input)
+	w := &bytes.Buffer{}
+
+	runner := &Runner{}
+	err := runner.Run(r, w)
+	assert.NoError(t, err)
+	assert.Contains(t, w.String(), "only functionConfig of kind ApplyReplacements")
+}

internal/builtins/builtin_runtime.go

@@ -12,11 +12,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package builtins registers all built-in KRM functions into the builtin registry.
+// Package builtins registers all built-in KRM functions into the builtin registry
+// via their init() functions.
 package builtins
 
 import (
-	// Register built-in functions via init()
+	// Register apply-replacements builtin function via init()
 	_ "github.com/kptdev/kpt/internal/builtins/applyreplacements"
+	// Register starlark builtin function via init()
 	_ "github.com/kptdev/kpt/internal/builtins/starlark"
 )

internal/builtins/registry/registry.go

@@ -16,6 +16,7 @@ package registry
 
 import (
 	"io"
+	"log"
 	"strings"
 	"sync"
 )
@@ -39,7 +40,13 @@ func Register(fn BuiltinFunction) {
 func Lookup(imageName string) BuiltinFunction {
 	mu.RLock()
 	defer mu.RUnlock()
-	return registry[normalizeImage(imageName)]
+	normalized := normalizeImage(imageName)
+	fn := registry[normalized]
+	if fn != nil && imageName != normalized {
+		log.Printf("WARNING: builtin function %q is being used instead of the requested image %q. "+
+			"The built-in implementation may differ from the pinned version.", normalized, imageName)
+	}
+	return fn
 }
 
 func List() []string {

internal/builtins/registry/registry_test.go

@@ -0,0 +1,70 @@
+// Copyright 2026 The kpt Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package registry
+
+import (
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type fakeBuiltin struct {
+	name string
+}
+
+func (f *fakeBuiltin) ImageName() string                  { return f.name }
+func (f *fakeBuiltin) Run(_ io.Reader, _ io.Writer) error { return nil }
+
+func TestNormalizeImage(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"ghcr.io/kptdev/starlark:v0.5.0", "ghcr.io/kptdev/starlark"},
+		{"ghcr.io/kptdev/starlark@sha256:abc123", "ghcr.io/kptdev/starlark"},
+		{"ghcr.io/kptdev/starlark:v0.5.0@sha256:abc123", "ghcr.io/kptdev/starlark"},
+		{"ghcr.io/kptdev/starlark", "ghcr.io/kptdev/starlark"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.input, func(t *testing.T) {
+			assert.Equal(t, tc.expected, normalizeImage(tc.input))
+		})
+	}
+}
+
+func TestRegisterAndLookup(t *testing.T) {
+	registry = map[string]BuiltinFunction{}
+
+	fn := &fakeBuiltin{name: "ghcr.io/kptdev/test:v1.0"}
+	Register(fn)
+
+	result := Lookup("ghcr.io/kptdev/test:v2.0")
+	assert.NotNil(t, result)
+	assert.Equal(t, fn, result)
+
+	result = Lookup("ghcr.io/kptdev/unknown")
+	assert.Nil(t, result)
+}
+
+func TestList(t *testing.T) {
+	registry = map[string]BuiltinFunction{}
+
+	Register(&fakeBuiltin{name: "ghcr.io/kptdev/fn1:v1"})
+	Register(&fakeBuiltin{name: "ghcr.io/kptdev/fn2:v1"})
+
+	list := List()
+	assert.Len(t, list, 2)
+}

internal/builtins/starlark/config.go

@@ -17,7 +17,7 @@ package starlark
 import (
 	"fmt"
 
-	"github.com/kptdev/krm-functions-catalog/functions/go/starlark/third_party/sigs.k8s.io/kustomize/kyaml/fn/runtime/starlark"
+	starlarkruntime "github.com/kptdev/krm-functions-catalog/functions/go/starlark/third_party/sigs.k8s.io/kustomize/kyaml/fn/runtime/starlark"
 	"github.com/kptdev/krm-functions-sdk/go/fn"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -104,7 +104,7 @@ func (sr *Run) Transform(rl *fn.ResourceList) error {
 		nodes = append(nodes, objRN)
 	}
 
-	starFltr := &starlark.SimpleFilter{
+	starFltr := &starlarkruntime.SimpleFilter{
 		Name:           sr.Name,
 		Program:        sr.Source,
 		FunctionConfig: fcRN,

internal/builtins/starlark/processor.go

@@ -34,7 +34,7 @@ func Process(resourceList *fn.ResourceList) (bool, error) {
 				Severity: fn.Error,
 			},
 		}
-		return false, nil
+		return false, err
 	}
 
 	return true, nil

internal/builtins/starlark/processor_test.go

@@ -0,0 +1,72 @@
+// Copyright 2026 The kpt Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package starlark
+
+import (
+	"testing"
+
+	"github.com/kptdev/krm-functions-sdk/go/fn"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestProcess_SetNamespace(t *testing.T) {
+	input := `apiVersion: config.kubernetes.io/v1
+kind: ResourceList
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: my-app
+    namespace: old-namespace
+functionConfig:
+  apiVersion: fn.kpt.dev/v1alpha1
+  kind: StarlarkRun
+  metadata:
+    name: set-namespace
+  source: |
+    def run(r, ns_value):
+      for resource in r:
+        resource["metadata"]["namespace"] = ns_value
+    run(ctx.resource_list["items"], "new-namespace")
+`
+	rl, err := fn.ParseResourceList([]byte(input))
+	assert.NoError(t, err)
+
+	ok, err := Process(rl)
+	assert.NoError(t, err)
+	assert.True(t, ok)
+	assert.Equal(t, "new-namespace", rl.Items[0].GetNamespace())
+}
+
+func TestProcess_InvalidScript(t *testing.T) {
+	input := `apiVersion: config.kubernetes.io/v1
+kind: ResourceList
+items: []
+functionConfig:
+  apiVersion: fn.kpt.dev/v1alpha1
+  kind: StarlarkRun
+  metadata:
+    name: bad-script
+  source: |
+    this is not valid starlark!!!
+`
+	rl, err := fn.ParseResourceList([]byte(input))
+	assert.NoError(t, err)
+
+	ok, err := Process(rl)
+	assert.Error(t, err)
+	assert.False(t, ok)
+	assert.Len(t, rl.Results, 1)
+}

internal/builtins/starlark/starlark.go

@@ -24,15 +24,18 @@ import (
 
 const ImageName = "ghcr.io/kptdev/krm-functions-catalog/starlark"
 
-func init() {
-	registry.Register(&StarlarkRunner{})
+//nolint:gochecknoinits
+func init() { Register() }
+
+func Register() {
+	registry.Register(&Runner{})
 }
 
-type StarlarkRunner struct{}
+type Runner struct{}
 
-func (s *StarlarkRunner) ImageName() string { return ImageName }
+func (s *Runner) ImageName() string { return ImageName }
 
-func (s *StarlarkRunner) Run(r io.Reader, w io.Writer) error {
+func (s *Runner) Run(r io.Reader, w io.Writer) error {
 	input, err := io.ReadAll(r)
 	if err != nil {
 		return fmt.Errorf("reading input: %w", err)
@@ -41,13 +44,13 @@ func (s *StarlarkRunner) Run(r io.Reader, w io.Writer) error {
 	if err != nil {
 		return fmt.Errorf("parsing ResourceList: %w", err)
 	}
-	if _, err := Process(rl); err != nil {
-		return err
-	}
+	_, processErr := Process(rl)
 	out, err := rl.ToYAML()
 	if err != nil {
 		return err
 	}
-	_, err = w.Write(out)
-	return err
+	if _, err = w.Write(out); err != nil {
+		return err
+	}
+	return processErr
 }