style(scripts): harden add-annotations.sh to follow shell best practices

Apply shell scripting conventions to improve robustness and consistency:
- Enable `set -u` (nounset) to catch unset variable references early
- Add trap-based cleanup for temporary files instead of manual rm
- Use `readonly` for constants (CHART_FILE, RC_PATTERN)
- Replace `[ ]` with `[[ ]]` throughout for modern bash conditionals
- Use `read -r` to prevent backslash interpretation
- Use `${1:-}` / `${2:-}` for safe positional parameter access under nounset
- Normalize stderr redirect to `>&2`
- Remove `function` keyword, align `;;` in case statements

Co-authored-by: Copilot <copilot@github.com>

.gitea/scripts/add-annotations.sh

@@ -1,92 +1,104 @@
 #!/bin/bash
 
-set -eo pipefail
+# ============================================================================
+# Generate ArtifactHub changelog annotations from git commit history
+# ============================================================================
 
-CHART_FILE="Chart.yaml"
-if [ ! -f "${CHART_FILE}" ]; then
-  echo "ERROR: ${CHART_FILE} not found!" 1>&2
+set -euo pipefail
+
+readonly CHART_FILE="Chart.yaml"
+readonly RC_PATTERN="\-rc([-\.][0-9]+)?$"
+
+CHANGE_LOG_YAML=""
+
+cleanup() {
+  if [[ -n "${CHANGE_LOG_YAML:-}" && -f "${CHANGE_LOG_YAML}" ]]; then
+    rm -f "${CHANGE_LOG_YAML}"
+  fi
+}
+trap cleanup EXIT
+
+if [[ ! -f "${CHART_FILE}" ]]; then
+  echo "ERROR: ${CHART_FILE} not found!" >&2
   exit 1
 fi
 
-rc_pattern="\-rc([-\.][0-9]+)?$"
-
 # Exclude prerelease tags (matching -rc or -rc.<digits>) from default tag selection
-DEFAULT_NEW_TAG="$(git tag --sort=-version:refname | grep --invert-match --perl-regexp "${rc_pattern}" | head --lines 1)"
-DEFAULT_OLD_TAG="$(git tag --sort=-version:refname | grep --invert-match --perl-regexp "${rc_pattern}" | head --lines 2 | tail --lines 1)"
+DEFAULT_NEW_TAG="$(git tag --sort=-version:refname | grep --invert-match --perl-regexp "${RC_PATTERN}" | head --lines 1)"
+DEFAULT_OLD_TAG="$(git tag --sort=-version:refname | grep --invert-match --perl-regexp "${RC_PATTERN}" | head --lines 2 | tail --lines 1)"
 
-if [ -z "${1}" ]; then
-  read -p "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
-  if [ -z "${OLD_TAG}" ]; then
+if [[ -z "${1:-}" ]]; then
+  read -rp "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
+  if [[ -z "${OLD_TAG}" ]]; then
     OLD_TAG="${DEFAULT_OLD_TAG}"
   fi
 
-  while [ -z "$(git tag --list "${OLD_TAG}")" ]; do
-    echo "ERROR: Tag '${OLD_TAG}' not found!" 1>&2
-    read -p "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
-    if [ -z "${OLD_TAG}" ]; then
+  while [[ -z "$(git tag --list "${OLD_TAG}")" ]]; do
+    echo "ERROR: Tag '${OLD_TAG}' not found!" >&2
+    read -rp "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
+    if [[ -z "${OLD_TAG}" ]]; then
       OLD_TAG="${DEFAULT_OLD_TAG}"
     fi
   done
 else
-  OLD_TAG=${1}
-  if [ -z "$(git tag --list "${OLD_TAG}")" ]; then
-    echo "ERROR: Tag '${OLD_TAG}' not found!" 1>&2
+  OLD_TAG="${1}"
+  if [[ -z "$(git tag --list "${OLD_TAG}")" ]]; then
+    echo "ERROR: Tag '${OLD_TAG}' not found!" >&2
     exit 1
   fi
 fi
 
-if [ -z "${2}" ]; then
-  read -p "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
-  if [ -z "${NEW_TAG}" ]; then
+if [[ -z "${2:-}" ]]; then
+  read -rp "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
+  if [[ -z "${NEW_TAG}" ]]; then
     NEW_TAG="${DEFAULT_NEW_TAG}"
   fi
 
-  while [ -z "$(git tag --list "${NEW_TAG}")" ]; do
-    echo "ERROR: Tag '${NEW_TAG}' not found!" 1>&2
-    read -p "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
-    if [ -z "${NEW_TAG}" ]; then
+  while [[ -z "$(git tag --list "${NEW_TAG}")" ]]; do
+    echo "ERROR: Tag '${NEW_TAG}' not found!" >&2
+    read -rp "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
+    if [[ -z "${NEW_TAG}" ]]; then
       NEW_TAG="${DEFAULT_NEW_TAG}"
     fi
   done
 else
-  NEW_TAG=${2}
+  NEW_TAG="${2}"
 
-  if [ -z "$(git tag --list "${NEW_TAG}")" ]; then
-    echo "ERROR: Tag '${NEW_TAG}' not found!" 1>&2
+  if [[ -z "$(git tag --list "${NEW_TAG}")" ]]; then
+    echo "ERROR: Tag '${NEW_TAG}' not found!" >&2
     exit 1
   fi
 fi
 
-# Check if NEW_TAG is a prerelease (matches -rc or -rc-<digits> suffix)
-if [[ "${NEW_TAG}" =~ ${rc_pattern} ]]; then
+if [[ "${NEW_TAG}" =~ ${RC_PATTERN} ]]; then
   echo "INFO: Tag '${NEW_TAG}' is a prerelease, setting prerelease annotation and skipping changelog."
   yq --no-colors --inplace ".annotations.\"artifacthub.io/prerelease\" = \"true\" | sort_keys(.)" "${CHART_FILE}"
   exit 0
 fi
 
-CHANGE_LOG_YAML=$(mktemp)
+CHANGE_LOG_YAML="$(mktemp)"
 echo "[]" > "${CHANGE_LOG_YAML}"
 
-function map_type_to_kind() {
+map_type_to_kind() {
   case "${1}" in
     feat)
       echo "added"
-    ;;
+      ;;
     fix)
       echo "fixed"
-    ;;
+      ;;
     chore|style|test|ci|docs|refac)
       echo "changed"
-    ;;
+      ;;
     revert)
       echo "removed"
-    ;;
+      ;;
     sec)
       echo "security"
-    ;;
+      ;;
     *)
       echo "skip"
-    ;;
+      ;;
   esac
 }
 
@@ -97,9 +109,9 @@ echo "INFO: Generate change log entries from ${OLD_TAG} until ${NEW_TAG}"
 while IFS= read -r line; do
   if [[ "${line}" =~ ^([a-zA-Z]+)(\([^\)]+\))?\:\ (.+)$ ]]; then
     TYPE="${BASH_REMATCH[1]}"
-    KIND=$(map_type_to_kind "${TYPE}")
+    KIND="$(map_type_to_kind "${TYPE}")"
 
-    if [ "${KIND}" == "skip" ]; then
+    if [[ "${KIND}" == "skip" ]]; then
       continue
     fi
 
@@ -109,16 +121,13 @@ while IFS= read -r line; do
 
     jq --arg kind "${KIND}" --arg description "${DESC}" '. += [ $ARGS.named ]' < "${CHANGE_LOG_YAML}" > "${CHANGE_LOG_YAML}.new"
     mv "${CHANGE_LOG_YAML}.new" "${CHANGE_LOG_YAML}"
-
   fi
 done <<< "${COMMIT_TITLES}"
 
-if [ -s "${CHANGE_LOG_YAML}" ]; then
+if [[ -s "${CHANGE_LOG_YAML}" ]]; then
   yq --inplace --input-format json --output-format yml "${CHANGE_LOG_YAML}"
   yq --no-colors --inplace ".annotations.\"artifacthub.io/changes\" |= loadstr(\"${CHANGE_LOG_YAML}\") | sort_keys(.)" "${CHART_FILE}"
 else
-  echo "ERROR: Changelog file is empty: ${CHANGE_LOG_YAML}" 1>&2
+  echo "ERROR: Changelog file is empty: ${CHANGE_LOG_YAML}" >&2
   exit 1
 fi
-
-rm "${CHANGE_LOG_YAML}"

.gitea/workflows/artifacthub-metadata.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ${{ github.server_url }}
         username: ${{ github.repository_owner }}

.gitea/workflows/generate-readme.yaml

@@ -15,7 +15,7 @@ on:
 jobs:
   generate-parameters:
     container:
-      image: docker.io/library/node:26.5.0-alpine
+      image: docker.io/library/node:26.7.0-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling

.gitea/workflows/helm.yaml

@@ -17,7 +17,7 @@ jobs:
     - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
-        version: v4.2.3 # renovate: datasource=github-releases depName=helm/helm
+        version: v4.2.4 # renovate: datasource=github-releases depName=helm/helm
     - name: Lint helm files
       run: |
         helm lint --values values.yaml .
@@ -28,7 +28,7 @@ jobs:
     - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
-        version: v4.2.3 # renovate: datasource=github-releases depName=helm/helm
+        version: v4.2.4 # renovate: datasource=github-releases depName=helm/helm
     - env:
         HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
       name: Install helm-unittest

.gitea/workflows/markdown-linters.yaml

@@ -15,7 +15,7 @@ on:
 jobs:
   markdown-link-checker:
     container:
-      image: docker.io/library/node:26.5.0-alpine
+      image: docker.io/library/node:26.7.0-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling
@@ -30,7 +30,7 @@ jobs:
 
   markdown-lint:
     container:
-      image: docker.io/library/node:26.5.0-alpine
+      image: docker.io/library/node:26.7.0-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling

.gitea/workflows/release.yaml

@@ -16,11 +16,11 @@ jobs:
     steps:
       - uses: volker-raschek/cosign-installer@7643eed6736a199595ed2a31e9979ec353a88adb # v4.1.3-rc3
         with:
-          cosign-release: "v3.1.2" # renovate: datasource=github-tags depName=sigstore/cosign
+          cosign-release: "v3.1.3" # renovate: datasource=github-tags depName=sigstore/cosign
 
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          version: "v4.2.3" # renovate: datasource=github-tags depName=helm/helm
+          version: "v4.2.4" # renovate: datasource=github-tags depName=helm/helm
 
       - name: Install helm plugins
         env:
@@ -96,7 +96,7 @@ jobs:
             --passphrase-file "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" \
             --version "${PACKAGE_VERSION}" ./
 
-      - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ github.server_url }}
           username: ${{ github.repository_owner }}