Fossa 3.14.0

.github/workflows/ci.yaml

@@ -7,47 +7,49 @@ on:
   pull_request:
     branches:
       - '*'
+
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
 
       - name: checkout
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: shellcheck
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
 
       - name: Setup go
-        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version-file: './go.mod'
+          go-version: '1.25'
           check-latest: true
+          cache: false
 
-      - name: Install Helm
-        run: |
-          helm_version=v3.11.2-fossa.1
-          curl -fsSLO "https://github.com/fossas/helm-cli/releases/download/$helm_version/helm--linux-amd64.tar.gz"
-          sudo mkdir -p "/usr/local/helm-$helm_version"
-          sudo tar -xzf "helm--linux-amd64.tar.gz" -C "/usr/local/helm-$helm_version"
-          sudo rm -f /usr/local/bin/helm
-          sudo ln -s "/usr/local/helm-$helm_version/linux-amd64/helm" /usr/local/bin/helm
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           install-only: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
 
       - name: Install syft
-        uses: anchore/sbom-action/download-syft@448520c4f19577ffce70a8317e619089054687e3 # v0.14.0
+        uses: anchore/sbom-action/download-syft@62ad5284b8ced813296287a0b63906cb364b73ee # v0.22.0
 
       - name: Install k8s Kind
-        uses: helm/kind-action@d8ccf8fb623ce1bb360ae2f45f323d9d5c5e9f00 # v1.3.0
+        uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.3.0
         with:
           install_only: true
 
@@ -71,10 +73,10 @@ jobs:
           git diff --exit-code
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v2.5.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build
         run: |
@@ -87,12 +89,20 @@ jobs:
   check-docs:
     name: check-docs
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
-      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          go-version-file: './go.mod'
+          persist-credentials: false
+
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version: '1.25'
           check-latest: true
+          cache: false
 
       - name: generate docs
         run: |
@@ -108,16 +118,25 @@ jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
-      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          go-version-file: './go.mod'
+          persist-credentials: false
+
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version: '1.25'
           check-latest: true
+          cache: false
+
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # v3
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
-          version: v1.52.1
+          version: v2.7
 
   dependency-scan:
     name: dependency-scan

.github/workflows/release.yaml

@@ -6,6 +6,8 @@ on:
         description: Version
         required: true
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -17,29 +19,30 @@ jobs:
     steps:
 
       - name: checkout
-        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: shellcheck
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
 
       - name: Setup go
-        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version-file: './go.mod'
+          go-version: '1.25'
           check-latest: true
+          cache: false
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           install-only: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
 
       - name: Install syft
-        uses: anchore/sbom-action/download-syft@448520c4f19577ffce70a8317e619089054687e3 # v0.14.0
+        uses: anchore/sbom-action/download-syft@62ad5284b8ced813296287a0b63906cb364b73ee # v0.22.0
 
       - name: Install tools
         run: |
@@ -53,13 +56,13 @@ jobs:
           git diff --exit-code
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v2.5.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to registry
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: quay.io
           username: ${{ secrets.DOCKER_USERNAME }}

.golangci.yml

@@ -1,32 +1,42 @@
+---
+version: "2"
+run:
+  issues-exit-code: 1
 linters:
   enable:
     - asciicheck
-    - depguard
-    - errcheck
     - errorlint
-    - gofmt
-    - goimports
-    - gosec
     - gocritic
+    - gosec
     - importas
+    - misspell
     - prealloc
     - revive
-    - misspell
-    - stylecheck
+    - staticcheck
     - unconvert
-    - unused
     - whitespace
-output:
-  uniq-by-line: false
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck
-        - gosec
-        - revive
   max-issues-per-linter: 0
   max-same-issues: 0
-run:
-  issues-exit-code: 1
-  timeout: 10m
+  uniq-by-line: false
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.goreleaser.yml

@@ -1,4 +1,5 @@
 project_name: chart-testing
+version: 2
 
 env:
   - COSIGN_YES=true
@@ -23,6 +24,9 @@ builds:
       - linux
       - darwin
       - windows
+    ignore:
+      - goarch: arm
+        goos: windows
     flags:
       - -trimpath
     mod_timestamp: '{{ .CommitTimestamp }}'
@@ -33,10 +37,10 @@ builds:
         -X github.com/helm/chart-testing/v3/ct/cmd.BuildDate={{ .Date }}
 
 archives:
-  - rlcp: true
-    format_overrides:
+  - format_overrides:
       - goos: windows
-        format: zip
+        formats:
+          - zip
     files:
       - LICENSE
       - README.md
@@ -48,16 +52,14 @@ checksum:
 
 snapshot:
   name_template: "{{ .Tag }}-next"
-
 dockers:
-  - skip_push: false
-    use: buildx
+  - goarch: amd64
+    skip_push: false
     dockerfile: Dockerfile
     image_templates:
       - quay.io/fossa/chart-testing:{{ .Tag }}-amd64
       - quay.io/fossa/chart-testing:latest-amd64
     build_flag_templates:
-      - --platform=linux/amd64
       - --label=org.opencontainers.image.version={{ .Version }}
       - --label=org.opencontainers.image.revision={{ .Commit }}
       - --label=org.opencontainers.image.title={{ .ProjectName }}
@@ -93,14 +95,14 @@ dockers:
       - etc/lintconf.yaml
 
 docker_manifests:
-  - name_template: quay.io/fossa/chart-testing:latest
-    image_templates:
-      - quay.io/fossa/chart-testing:latest-amd64
-      - quay.io/fossa/chart-testing:latest-arm64
-  - name_template: quay.io/fossa/chart-testing:{{ .Tag }}
-    image_templates:
-      - quay.io/fossa/chart-testing:{{ .Tag }}-amd64
-      - quay.io/fossa/chart-testing:{{ .Tag }}-arm64
+- name_template: quay.io/fossa/chart-testing:latest
+  image_templates:
+  - quay.io/fossa/chart-testing:latest-amd64
+  - quay.io/fossa/chart-testing:latest-arm64
+- name_template: quay.io/fossa/chart-testing:{{ .Tag }}
+  image_templates:
+  - quay.io/fossa/chart-testing:{{ .Tag }}-amd64
+  - quay.io/fossa/chart-testing:{{ .Tag }}-arm64
 
 signs:
   - id: all
@@ -114,7 +116,6 @@ docker_signs:
   - id: images
     cmd: cosign
     args: ["sign", "${artifact}"]
-    artifacts: manifests
 
 changelog:
   use: github-native