chore(deps): update volkerraschek/helm docker tag to v4

Merge pull request 'chore(deps): update dependency markdownlint-cli to ^0.50.0' (#181 ) from renovate/markdownlint-cli-0.x into master
chore(deps): update dependency markdownlint-cli to ^0.50.0
2026-10-25 08:15:37 +00:00 · 2026-10-25 05:16:23 +00:00 · 2026-10-25 05:15:06 +00:00 · 2026-10-24 19:17:29 +00:00 · 2026-10-24 19:15:05 +00:00 · 2026-10-23 16:15:39 +00:00
14 changed files with 485 additions and 483 deletions
@@ -1,125 +0,0 @@
-#!/bin/bash
-
-set -e -o pipefail
-
-chart_file="Chart.yaml"
-if [ ! -f "${chart_file}" ]; then
-  echo "ERROR: ${chart_file} not found!" 1>&2
-  exit 1
-fi
-
-default_new_tag="$(git tag --sort=-version:refname | head -n 1)"
-default_old_tag="$(git tag --sort=-version:refname | head -n 2 | tail -n 1)"
-
-if [ -z "${1}" ]; then
-  echo "Enter start tag [${default_old_tag}]:"
-  read -r old_tag
-  if [ -z "${old_tag}" ]; then
-    old_tag="${default_old_tag}"
-  fi
-
-  while [ -z "$(git tag --list "${old_tag}")" ]; do
-    echo "ERROR: Tag '${old_tag}' not found!" 1>&2
-    echo "Enter start tag [${default_old_tag}]:"
-    read -r old_tag
-    if [ -z "${old_tag}" ]; then
-      old_tag="${default_old_tag}"
-    fi
-  done
-else
-  old_tag=${1}
-  if [ -z "$(git tag --list "${old_tag}")" ]; then
-    echo "ERROR: Tag '${old_tag}' not found!" 1>&2
-    exit 1
-  fi
-fi
-
-if [ -z "${2}" ]; then
-  echo "Enter end tag [${default_new_tag}]:"
-  read -r new_tag
-  if [ -z "${new_tag}" ]; then
-    new_tag="${default_new_tag}"
-  fi
-
-  while [ -z "$(git tag --list "${new_tag}")" ]; do
-    echo "ERROR: Tag '${new_tag}' not found!" 1>&2
-    echo "Enter end tag [${default_new_tag}]:"
-    read -r new_tag
-    if [ -z "${new_tag}" ]; then
-      new_tag="${default_new_tag}"
-    fi
-  done
-else
-  new_tag=${2}
-
-  if [ -z "$(git tag --list "${new_tag}")" ]; then
-    echo "ERROR: Tag '${new_tag}' not found!" 1>&2
-    exit 1
-  fi
-fi
-
-change_log_yaml=$(mktemp)
-echo "[]" > "${change_log_yaml}"
-
-function map_type_to_kind() {
-  case "${1}" in
-    feat)
-      echo "added"
-    ;;
-    fix)
-      echo "fixed"
-    ;;
-    chore|style|test|ci|docs|refac)
-      echo "changed"
-    ;;
-    revert)
-      echo "removed"
-    ;;
-    sec)
-      echo "security"
-    ;;
-    *)
-      echo "skip"
-    ;;
-  esac
-}
-
-commit_titles="$(git log --pretty=format:"%s" "${old_tag}..${new_tag}")"
-
-echo "INFO: Generate change log entries from ${old_tag} until ${new_tag}"
-
-while IFS= read -r line; do
-  if [[ "${line}" =~ ^([a-zA-Z]+)(\([^\)]+\))?\:\ (.+)$ ]]; then
-    type="${BASH_REMATCH[1]}"
-    kind=$(map_type_to_kind "${type}")
-
-    if [ "${kind}" == "skip" ]; then
-      continue
-    fi
-
-    desc="${BASH_REMATCH[3]}"
-
-    echo "- ${kind}: ${desc}"
-
-    jq --arg kind "${kind}" --arg description "${desc}" '. += [ $ARGS.named ]' < "${change_log_yaml}" > "${change_log_yaml}.new"
-    mv "${change_log_yaml}.new" "${change_log_yaml}"
-
-  fi
-done <<< "${commit_titles}"
-
-if [ -s "${change_log_yaml}" ]; then
-  yq --inplace --input-format json --output-format yml "${change_log_yaml}"
-  yq --no-colors --inplace ".annotations.\"artifacthub.io/changes\" |= loadstr(\"${change_log_yaml}\") | sort_keys(.)" "${chart_file}"
-else
-  echo "ERROR: Changelog file is empty: ${change_log_yaml}" 1>&2
-  exit 1
-fi
-
-rm "${change_log_yaml}"
-
-regexp=".*-alpha-[0-9]+(\.[0-9]+){,2}$"
-if [[ "${new_tag}" =~ $regexp ]]; then
-  yq --inplace '.annotations."artifacthub.io/prerelease" = "true"' "${chart_file}"
-else
-  yq --inplace '.annotations."artifacthub.io/prerelease" = "false"' "${chart_file}"
-fi
@@ -10,15 +10,15 @@ jobs:
    name: "Upload artifacthub-repo.yml to OCI registry"
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: docker/login-action@v4.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
      with:
        registry: ${{ github.server_url }}
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
-    - uses: oras-project/setup-oras@v2.0.0
+    - uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
      with:
-        version: 1.3.2 # renovate: datasource=github-tags depName=oras-project/oras extractVersion='^v?(?<version>.*)$'
+        version: 1.3.6 # renovate: datasource=github-tags depName=oras-project/oras extractVersion='^v?(?<version>.*)$'
    - name: Extract meta information
      run: |
        echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut -d '/' -f 3)" >> $GITHUB_ENV
@@ -15,14 +15,14 @@ on:
 jobs:
  generate-parameters:
    container:
-      image: docker.io/library/node:25.9.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
    runs-on: ubuntu-latest
    steps:
    - name: Install tooling
      run: |
        apk update
        apk add git npm
-    - uses: actions/checkout@v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Generate parameter section in README
      run: |
        npm install
@@ -14,10 +14,10 @@ jobs:
  helm-lint:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: azure/setup-helm@v5.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
      with:
-        version: "v4.1.4" # renovate: datasource=github-tags depName=helm/helm
+        version: "v4.3.1" # renovate: datasource=github-tags depName=helm/helm
    - name: Lint helm files
      run: |
        helm lint --values values.yaml .
@@ -25,10 +25,10 @@ jobs:
  helm-unittest:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: azure/setup-helm@v5.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
      with:
-        version: "v4.1.4" # renovate: datasource=github-tags depName=helm/helm
+        version: "v4.3.1" # renovate: datasource=github-tags depName=helm/helm
    - env:
        HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
      name: Install helm-unittest
@@ -15,14 +15,14 @@ on:
 jobs:
  markdown-link-checker:
    container:
-      image: docker.io/library/node:25.9.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
    runs-on: ubuntu-latest
    steps:
    - name: Install tooling
      run: |
        apk update
        apk add git npm
-    - uses: actions/checkout@v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Verify links in markdown files
      run: |
        npm install
@@ -30,14 +30,14 @@ jobs:

  markdown-lint:
    container:
-      image: docker.io/library/node:25.9.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
    runs-on: ubuntu-latest
    steps:
    - name: Install tooling
      run: |
        apk update
        apk add git
-    - uses: actions/checkout@v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Lint markdown files
      run: |
        npm install
@@ -14,19 +14,19 @@ jobs:
  publish-chart:
    runs-on: ubuntu-latest
    steps:
-      - uses: volker-raschek/cosign-installer@v4.1.2-rc3
+      - uses: volker-raschek/cosign-installer@7643eed6736a199595ed2a31e9979ec353a88adb # v4.1.3-rc3
        with:
-          cosign-release: "v3.0.6" # renovate: datasource=github-tags depName=sigstore/cosign
+          cosign-release: "v3.1.4" # renovate: datasource=github-tags depName=sigstore/cosign

-      - uses: azure/setup-helm@v5.0.0
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
-          version: "v4.1.4" # renovate: datasource=github-tags depName=helm/helm
+          version: "v4.3.1" # renovate: datasource=github-tags depName=helm/helm

      - name: Install helm plugins
        env:
          HELM_SIGSTORE_VERSION: "0.3.0" # renovate: datasource=github-tags depName=sigstore/helm-sigstore extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
-          HELM_SCHEMA_VALUES_VERSION: "2.3.1" # renovate: datasource=github-tags depName=losisin/helm-values-schema-json extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
-          HELM_UNITTEST_VERSION: "1.0.3" # renovate: datasource=github-tags depName=helm-unittest/helm-unittest extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
+          HELM_SCHEMA_VALUES_VERSION: "2.6.0" # renovate: datasource=github-tags depName=losisin/helm-values-schema-json extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
+          HELM_UNITTEST_VERSION: "1.2.1" # renovate: datasource=github-tags depName=helm-unittest/helm-unittest extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
        run: |
          helm plugin install --verify=false https://github.com/sigstore/helm-sigstore.git --version "${HELM_SIGSTORE_VERSION}" 1> /dev/null
          helm plugin install --verify=false https://github.com/losisin/helm-values-schema-json.git --version "${HELM_SCHEMA_VALUES_VERSION}" 1> /dev/null
@@ -65,15 +65,11 @@ jobs:
          gpg --batch --yes --export "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/pubring.gpg"
          gpg --batch --yes --passphrase-fd 0 --export-secret-keys "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/secring.gpg" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}"

-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

-      - name: Add Artifacthub.io annotations
-        run: |
-          NEW_TAG="$(git tag --sort=-version:refname | head -n 1)"
-          OLD_TAG="$(git tag --sort=-version:refname | head -n 2 | tail -n 1)"
-          .gitea/scripts/add-annotations.sh "${OLD_TAG}" "${NEW_TAG}"
+      - uses: volker-raschek/ah-annotations@5b4361f7865c1e71a9ce2263df1c780871e0fee8 # v0.2.4

      - name: Extract meta information
        run: |
@@ -95,7 +91,7 @@ jobs:
            --passphrase-file "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" \
            --version "${PACKAGE_VERSION}" ./

-      - uses: docker/login-action@v4.1.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ${{ github.server_url }}
          username: ${{ github.repository_owner }}
@@ -121,15 +117,21 @@ jobs:
            --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz" \
              https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/charts

-          if [ -f "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" ]; then
-            curl \
-              --fail \
-              --show-error \
-              --request POST \
-              --user "${CHARTMUSEUM_USERNAME}:${CHARTMUSEUM_PASSWORD}" \
-              --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" \
-                https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/prov
-          fi
+          # NOTE:
+          # Gitea does currently not support uploading Helm chart provenance files, so we skip this step for now. Once
+          # Gitea supports this, we can simply uncomment the following lines to upload the provenance file as well.
+          #
+          #   https://github.com/helm/helm/issues/31866
+          #
+          # if [ -f "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" ]; then
+          #   curl \
+          #     --fail \
+          #     --show-error \
+          #     --request POST \
+          #     --user "${CHARTMUSEUM_USERNAME}:${CHARTMUSEUM_PASSWORD}" \
+          #     --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" \
+          #       https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/prov
+          # fi

      - name: Upload Chart to Chartmuseum (Helm)
        env:
@@ -1,4 +1,5 @@
 charts
+cosign*
 node_modules
 target
 values2.yml
@@ -3,7 +3,7 @@
    ".gitea/workflows/*.yaml": "github-actions-workflow"
  },
  "yaml.schemas": {
-    "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.0.3/schema/helm-testsuite.json": [
+    "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.2.1/schema/helm-testsuite.json": [
      "/unittests/**/*.yaml"
    ]
  },
@@ -11,7 +11,7 @@ annotations:
    fingerprint: 3B0CE9853CAD76076260025383D342258456906E
    url: https://keys.openpgp.org/vks/v1/by-fingerprint/3B0CE9853CAD76076260025383D342258456906E
 apiVersion: v2
-appVersion: "0.1.1"
+appVersion: "0.4.25"
 description: Prometheus metric exporter for Fail2Ban
 home: https://git.cryptic.systems/volker.raschek/prometheus-fail2ban-exporter-charts
 # icon: https://annotations.example.com/icon.png
@@ -4,7 +4,7 @@ CONTAINER_RUNTIME?=$(shell which podman)
 # HELM_IMAGE
 HELM_IMAGE_REGISTRY_HOST?=docker.io
 HELM_IMAGE_REPOSITORY?=volkerraschek/helm
-HELM_IMAGE_VERSION?=3.19.0 # renovate: datasource=docker registryUrl=https://docker.io depName=docker.io/volkerraschek/helm
+HELM_IMAGE_VERSION?=4.3.1 # renovate: datasource=docker registryUrl=https://docker.io depName=volkerraschek/helm
 HELM_IMAGE_FULLY_QUALIFIED=${HELM_IMAGE_REGISTRY_HOST}/${HELM_IMAGE_REPOSITORY}:${HELM_IMAGE_VERSION}

 # NODE_IMAGE
@@ -33,9 +33,9 @@ separate [chapter](#argocd).
 > time is not possible.

 ```bash
-helm repo add prometheus-exporters https://git.cryptic.systems/api/packages/volker.raschek/helm
+helm repo add prometheus-exporters https://charts.cryptic.systems/prometheus-exporters
 helm repo update
-CHART_VERSION=0.4.21
+CHART_VERSION=0.4.25
 helm install --version "${CHART_VERSION}" prometheus-fail2ban-exporter prometheus-exporters/prometheus-fail2ban-exporter \
  --set 'prometheus.metrics.enabled=true' \
  --set 'prometheus.metrics.serviceMonitor.enabled=true'
@@ -59,7 +59,7 @@ version of the chart must be in sync with the `values.yaml`. Newer *minor* versi
 versions can break something!

 ```bash
-CHART_VERSION=0.4.21
+CHART_VERSION=0.4.25
 helm show values --version "${CHART_VERSION}" prometheus-exporters/prometheus-fail2ban-exporter > values.yaml
 ```

@@ -97,7 +97,7 @@ Further information about this topic can be found in one of Kanishk's blog
 > Please take care the a CPU limit < `1000m` can also lead to CPU throttling. Please read the linked documentation carefully.

 ```bash
-CHART_VERSION=0.4.21
+CHART_VERSION=0.4.25
 helm install --version "${CHART_VERSION}" prometheus-fail2ban-exporter prometheus-exporters/prometheus-fail2ban-exporter \
  --set 'prometheus.metrics.enabled=true' \
  --set 'prometheus.metrics.serviceMonitor.enabled=true' \
@@ -115,7 +115,7 @@ the Grafana container file system so that it is subsequently available to the us
 makes this possible.

 ```bash
-CHART_VERSION=0.4.21
+CHART_VERSION=0.4.25
 helm install --version "${CHART_VERSION}" prometheus-fail2ban-exporter prometheus-exporters/prometheus-fail2ban-exporter \
  --set 'grafana.enabled=true'
 ```
@@ -16,6 +16,6 @@
  "devDependencies": {
    "@bitnami/readme-generator-for-helm": "^2.5.0",
    "markdown-link-check": "^3.13.6",
-    "markdownlint-cli": "^0.48.0"
+    "markdownlint-cli": "^0.50.0"
  }
 }
@@ -4,6 +4,7 @@
    "local>volker.raschek/renovate-config:default#master",
    "local>volker.raschek/renovate-config:container#master",
    "local>volker.raschek/renovate-config:actions#master",
+    "local>volker.raschek/renovate-config:helm#master",
    "local>volker.raschek/renovate-config:npm#master",
    "local>volker.raschek/renovate-config:regexp#master"
  ],
@@ -14,7 +15,7 @@
        "^Chart\\.yaml$"
      ],
      "matchStrings": [
-        "appVersion: \"(?<currentValue>.*?)\"\\s+"
+        "appVersion: \"?(?<currentValue>[^\"\\s]+)\"?\\s*"
      ],
      "datasourceTemplate": "docker",
      "depNameTemplate": "volker.raschek/prometheus-fail2ban-exporter",
@@ -31,33 +32,9 @@
      "packageNameTemplate": "https://git.cryptic.systems/volker.raschek/prometheus-fail2ban-exporter-charts",
      "datasourceTemplate": "git-tags",
      "versioningTemplate": "semver"
-    },
-    {
-      "customType": "regex",
-      "datasourceTemplate": "github-releases",
-      "fileMatch": [
-        ".vscode/settings\\.json$"
-      ],
-      "matchStrings": [
-        "https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json"
-      ]
    }
  ],
  "packageRules": [
-    {
-      "automerge": true,
-      "groupName": "Update helm plugin 'unittest'",
-      "matchDepNames": [
-        "helm-unittest/helm-unittest"
-      ],
-      "matchDatasources": [
-        "github-releases"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ]
-    },
    {
      "groupName": "Update docker.io/library/node",
      "matchDepNames": [