updates to prepare for release

.github/dependabot.yml

@@ -5,6 +5,8 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     groups:
       gomod:
@@ -15,6 +17,8 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     groups:
       actions:
@@ -26,6 +30,8 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       docker:
         update-types:

.github/workflows/ci.yaml

@@ -25,12 +25,12 @@ jobs:
           persist-credentials: false
 
       - name: shellcheck
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
 
       - name: Setup go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache: false
 
@@ -42,13 +42,13 @@ jobs:
           install-only: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Install syft
         uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
 
       - name: Install k8s Kind
-        uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.3.0
+        uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.15.0
         with:
           install_only: true
 
@@ -99,7 +99,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache: false
 
@@ -128,11 +128,11 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache: false
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.12
+          version: v2.14

.github/workflows/release.yaml

@@ -25,12 +25,12 @@ jobs:
           persist-credentials: true
 
       - name: shellcheck
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
 
       - name: Setup go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache: false
 
@@ -40,7 +40,7 @@ jobs:
           install-only: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Install syft
         uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
@@ -73,6 +73,11 @@ jobs:
         env:
           INPUTS_VERSION: ${{ github.event.inputs.version }}
         run: |
+          if [[ ! "${INPUTS_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "Invalid version '${INPUTS_VERSION}': expected vX.Y.Z or vX.Y.Z-<prerelease>" >&2
+            exit 1
+          fi
+
           git config user.name "$GITHUB_ACTOR"
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 

.github/workflows/zizmor.yaml

@@ -0,0 +1,30 @@
+name: zizmor
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    branches:
+      - '*'
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      actions: read
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false

.goreleaser.yml

@@ -58,7 +58,7 @@ dockers_v2:
       - "quay.io/helmpack/chart-testing"
     tags:
       - "{{ .Tag }}"
-      - "latest"
+      - "{{ if not .Prerelease }}latest{{ end }}"
     labels:
       "org.opencontainers.image.version": "{{ .Version }}"
       "org.opencontainers.image.revision": "{{ .Commit }}"
@@ -75,16 +75,18 @@ dockers_v2:
 
 signs:
   - id: all
-    signature: "${artifact}.sig"
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sigstore.json"
     cmd: cosign
-    args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
+    args: ["sign-blob", "--bundle=${signature}", "${artifact}", "--yes"]
     artifacts: all
 
 docker_signs:
   - id: images
     cmd: cosign
-    args: ["sign", "${artifact}"]
+    args: ["sign", "${artifact}@${digest}", "--yes"]
+
+release:
+  prerelease: auto
 
 changelog:
   use: github-native

e2e-kind.sh

@@ -7,11 +7,11 @@ set -o pipefail
 CLUSTER_NAME=chart-testing
 readonly CLUSTER_NAME
 
-K8S_VERSION=v1.22.9
+K8S_VERSION=v1.37.0@sha256:a1ed56cfb0e7b93589bdf97c8cd566405a265939e3620fc4f5de89adff580ae5
 readonly K8S_VERSION
 
 create_kind_cluster() {
-    kind create cluster --name "$CLUSTER_NAME" --image "kindest/node:$K8S_VERSION" --wait 60s
+    kind create cluster --name "${CLUSTER_NAME}" --image "kindest/node:${K8S_VERSION}" --wait 60s
 
     kubectl cluster-info || kubectl cluster-info dump
     echo
@@ -29,7 +29,7 @@ test_e2e() {
 }
 
 cleanup() {
-    kind delete cluster --name "$CLUSTER_NAME"
+    kind delete cluster --name "${CLUSTER_NAME}"
     echo 'Done!'
 }
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/helm/chart-testing/v3
 
-go 1.26.0
+go 1.27
 
 require (
 	github.com/MakeNowJust/heredoc v1.0.0

pkg/tool/kubectl.go

@@ -103,7 +103,7 @@ func (k Kubectl) forceNamespaceDeletion(namespace string) error {
 		}
 		req.Header.Set("Content-Type", "application/json")
 
-		errMsg := "Error removing finalizer from namespace"
+		errMsg := "error removing finalizer from namespace"
 		client := retryablehttp.NewClient()
 		client.Logger = nil
 		if resp, err := client.Do(req); err != nil {