Cannot use helm/chart-testing-action

[adoroszlai]

helm/chart-testing-action v2.8.0 (latest release) is allowed:

infrastructure-actions/actions.yml

Lines 412 to 414 in a35f441

	helm/chart-testing-action:
	6ec842c01de15ebb84c8627d2744a0c2f2755c9f:
	tag: v2.8.0

but it uses astral-sh/setup-uv v7.0.0:

https://github.com/helm/chart-testing-action/blob/v2.8.0/action.yml#L24

which is not allowed:

infrastructure-actions/actions.yml

Lines 45 to 56 in a35f441

	astral-sh/setup-uv:
	681c641aba71e4a1c380be3ab5e12ad51f415867:
	tag: v7.1.6
	expires_at: 2026-05-15
	eac588ad8def6316056a12d4907a9d4d84ff7a3b:
	tag: v7.3.0
	expires_at: 2026-05-24
	5a095e7a2014a4212f075830d4f7277575a9d098:
	tag: v7.3.1
	expires_at: 2026-06-14
	37802adc94f370d6bfd71619e3f0bf239e1f3b78:
	tag: v7.6.0

So currently even the latest version of helm/chart-testing-action is unusable in practice.

[raboof]

Right - and the main branch is on a supported version (https://github.com/helm/chart-testing-action/blob/main/action.yml) but not released yet. I notice that even the main branch isn't on the most recent version, though.

As long as there's no known security issues with 7.0.0, I'd be fine with adding that one to the allowlist (with some reasonable expiration date). Would you be up for a PR?

[adoroszlai]

Would you be up for a PR?

Sure.

As long as there's no known security issues with 7.0.0

Nothing published.

with some reasonable expiration date

Would 2026-06-30 work?

Also, dependabot has a PR in helm/chart-testing-action to bump astral-sh/setup-uv (v7.3.0 -> v7.3.1) and sigstore/cosign-installer (v4.0.0 -> v4.1.0). While setup-uv will remain allowed, the new cosign-installer version, released 2 weeks ago, is not whitelisted here. Is dependabot supposed to be doing that?

[raboof]

with some reasonable expiration date

Would 2026-06-30 work?

Sounds good to me.

Also, dependabot has a PR in helm/chart-testing-action to bump astral-sh/setup-uv (v7.3.0 -> v7.3.1) and sigstore/cosign-installer (v4.0.0 -> v4.1.0). While setup-uv will remain allowed, the new cosign-installer version, released 2 weeks ago, is not whitelisted here. Is dependabot supposed to be doing that?

AFAICS cosign-installer is not in the allowlist at all yet, so that'd need to be PR'ed here. After that indeed dependabot should propose also allowlisting newer versions.

[adoroszlai]

AFAICS cosign-installer is not in the allowlist at all yet

infrastructure-actions/actions.yml

Lines 753 to 756 in 07eb6cf

	sigstore/cosign-installer:
	faadad0cce49287aee09b3a48701e75088a2c6ad:
	expires_at: 2026-12-31
	tag: v4.0.0

[raboof]

lol not sure how I missed that. Yeah then I'd expect a dependabot PR for the update (and would warmly welcome your review, https://github.com/apache/infrastructure-actions?tab=readme-ov-file#reviewing)