chore(deps): update tonistiigi/binfmt docker tag to v10.2.3

The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from
harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting
and made the multi arch builds fail sporadically.

The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a
second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal
registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering
were removed.

All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the
repositories.

.gitea/workflows/auto-release.yaml

@@ -13,11 +13,12 @@ env:
 jobs:
   tag_on_change:
     permissions:
+      actions: write
       contents: write
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -54,7 +55,7 @@ jobs:
 
       - name: Trigger "Push tagged images" workflow
         if: steps.check_change.outputs.changed == 'true'
-        uses: actions/github-script@v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const workflowFileName = 'release.yaml';

.gitea/workflows/build.yaml

@@ -15,9 +15,19 @@ jobs:
   build-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: docker/setup-qemu-action@v3.7.0
-      - uses: docker/setup-buildx-action@v4.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build image
         run: |
@@ -33,9 +43,19 @@ jobs:
   build-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: docker/setup-qemu-action@v3.7.0
-      - uses: docker/setup-buildx-action@v4.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build image
         run: |

.gitea/workflows/markdown-linters.yaml

@@ -15,7 +15,7 @@ jobs:
   markdown-lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: DavidAnson/markdownlint-cli2-action@v21.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -27,20 +27,29 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
 
-      - uses: docker/setup-qemu-action@v3.7.0
-      - uses: docker/setup-buildx-action@v4.0.0
-
-      - uses: docker/login-action@v4.0.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
       - name: Build and push image
         run: |
           docker buildx build \
@@ -67,20 +76,29 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
 
-      - uses: docker/setup-qemu-action@v3.7.0
-      - uses: docker/setup-buildx-action@v4.0.0
-
-      - uses: docker/login-action@v4.0.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
       - name: Build and push image
         run: |
           docker buildx build \
@@ -110,7 +128,7 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: docker/login-action@v4.0.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}

.gitea/workflows/update-docker-hub-description.yaml

@@ -13,8 +13,8 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: peter-evans/dockerhub-description@v5.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}
         password: ${{ secrets.DOCKER_IO_PASSWORD }}

Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/alpine:3.23.3
+FROM docker.io/library/alpine:3.24.1
 
 ARG HELM_VERSION
 

Makefile

@@ -1,6 +1,6 @@
 # HELM_VERSION
 # Only required to install a specify version
-HELM_VERSION?=v4.1.3 # renovate: datasource=github-releases depName=helm/helm
+HELM_VERSION?=v4.2.4 # renovate: datasource=github-releases depName=helm/helm
 
 # CONTAINER_RUNTIME
 # The CONTAINER_RUNTIME variable will be used to specified the path to a

README.md

@@ -7,7 +7,7 @@ goal of this project is to package the binary `helm` as container image and prov
 The source code of the binary can be found in the upstream project of [helm](github.com/helm/helm).
 
 ```bash
-IMAGE_VERSION=4.1.3
+IMAGE_VERSION=4.2.4
 docker run \
   --rm \
   --volume "$(pwd):$(pwd)" \