From 4c7808bd0804659cbc6f7a759dbbcc01a227e60e Mon Sep 17 00:00:00 2001 From: Carlos Panato Date: Tue, 6 Oct 2026 10:13:19 +0200 Subject: [PATCH] updates to prepare for release Signed-off-by: Carlos Panato --- .github/dependabot.yml | 6 ++++++ .github/workflows/ci.yaml | 14 +++++++------- .github/workflows/release.yaml | 11 ++++++++--- .github/workflows/zizmor.yaml | 30 ++++++++++++++++++++++++++++++ .goreleaser.yml | 12 +++++++----- e2e-kind.sh | 6 +++--- go.mod | 2 +- pkg/tool/kubectl.go | 2 +- 8 files changed, 63 insertions(+), 20 deletions(-) create mode 100644 .github/workflows/zizmor.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 04664fe9b..73543337e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,8 @@ updates: directory: "/" schedule: interval: weekly + cooldown: + default-days: 7 open-pull-requests-limit: 10 groups: gomod: @@ -15,6 +17,8 @@ updates: directory: "/" schedule: interval: weekly + cooldown: + default-days: 7 open-pull-requests-limit: 10 groups: actions: @@ -26,6 +30,8 @@ updates: directory: "/" schedule: interval: weekly + cooldown: + default-days: 7 groups: docker: update-types: diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 40d275b08..d23fc7916 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -25,12 +25,12 @@ jobs: persist-credentials: false - name: shellcheck - uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0 + uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 - name: Setup go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.26' + go-version: '1.27' check-latest: true cache: false @@ -42,13 +42,13 @@ jobs: install-only: true - name: Install cosign - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Install syft uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 - name: Install k8s Kind - uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.3.0 + uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.15.0 with: install_only: true @@ -99,7 +99,7 @@ jobs: - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.26' + go-version: '1.27' check-latest: true cache: false @@ -128,11 +128,11 @@ jobs: - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.26' + go-version: '1.27' check-latest: true cache: false - name: golangci-lint uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: - version: v2.12 + version: v2.14 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6b7c98112..1f532358f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -25,12 +25,12 @@ jobs: persist-credentials: true - name: shellcheck - uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0 + uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 - name: Setup go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.26' + go-version: '1.27' check-latest: true cache: false @@ -40,7 +40,7 @@ jobs: install-only: true - name: Install cosign - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Install syft uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 @@ -73,6 +73,11 @@ jobs: env: INPUTS_VERSION: ${{ github.event.inputs.version }} run: | + if [[ ! "${INPUTS_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then + echo "Invalid version '${INPUTS_VERSION}': expected vX.Y.Z or vX.Y.Z-" >&2 + exit 1 + fi + git config user.name "$GITHUB_ACTOR" git config user.email "$GITHUB_ACTOR@users.noreply.github.com" diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml new file mode 100644 index 000000000..24cd36ea6 --- /dev/null +++ b/.github/workflows/zizmor.yaml @@ -0,0 +1,30 @@ +name: zizmor +on: + push: + branches: + - 'main' + pull_request: + branches: + - '*' + +permissions: {} + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + + permissions: + contents: read + actions: read + + steps: + - name: checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + with: + advanced-security: false diff --git a/.goreleaser.yml b/.goreleaser.yml index e63a6f6f1..02ce4c104 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -58,7 +58,7 @@ dockers_v2: - "quay.io/helmpack/chart-testing" tags: - "{{ .Tag }}" - - "latest" + - "{{ if not .Prerelease }}latest{{ end }}" labels: "org.opencontainers.image.version": "{{ .Version }}" "org.opencontainers.image.revision": "{{ .Commit }}" @@ -75,16 +75,18 @@ dockers_v2: signs: - id: all - signature: "${artifact}.sig" - certificate: "${artifact}.pem" + signature: "${artifact}.sigstore.json" cmd: cosign - args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"] + args: ["sign-blob", "--bundle=${signature}", "${artifact}", "--yes"] artifacts: all docker_signs: - id: images cmd: cosign - args: ["sign", "${artifact}"] + args: ["sign", "${artifact}@${digest}", "--yes"] + +release: + prerelease: auto changelog: use: github-native diff --git a/e2e-kind.sh b/e2e-kind.sh index c8cff13ce..b6f1f5db1 100755 --- a/e2e-kind.sh +++ b/e2e-kind.sh @@ -7,11 +7,11 @@ set -o pipefail CLUSTER_NAME=chart-testing readonly CLUSTER_NAME -K8S_VERSION=v1.22.9 +K8S_VERSION=v1.37.0@sha256:a1ed56cfb0e7b93589bdf97c8cd566405a265939e3620fc4f5de89adff580ae5 readonly K8S_VERSION create_kind_cluster() { - kind create cluster --name "$CLUSTER_NAME" --image "kindest/node:$K8S_VERSION" --wait 60s + kind create cluster --name "${CLUSTER_NAME}" --image "kindest/node:${K8S_VERSION}" --wait 60s kubectl cluster-info || kubectl cluster-info dump echo @@ -29,7 +29,7 @@ test_e2e() { } cleanup() { - kind delete cluster --name "$CLUSTER_NAME" + kind delete cluster --name "${CLUSTER_NAME}" echo 'Done!' } diff --git a/go.mod b/go.mod index 832c03a99..d64dacd36 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/helm/chart-testing/v3 -go 1.26.0 +go 1.27 require ( github.com/MakeNowJust/heredoc v1.0.0 diff --git a/pkg/tool/kubectl.go b/pkg/tool/kubectl.go index ed707a7cb..22af4110c 100644 --- a/pkg/tool/kubectl.go +++ b/pkg/tool/kubectl.go @@ -103,7 +103,7 @@ func (k Kubectl) forceNamespaceDeletion(namespace string) error { } req.Header.Set("Content-Type", "application/json") - errMsg := "Error removing finalizer from namespace" + errMsg := "error removing finalizer from namespace" client := retryablehttp.NewClient() client.Logger = nil if resp, err := client.Do(req); err != nil {