chore: update dependencies

.github/workflows/checkov.yml

@@ -12,10 +12,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: '3.12'
 
@@ -32,6 +32,6 @@ jobs:
         continue-on-error: true
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: results.sarif

.github/workflows/gcs_chart_publish_insiders.yml

@@ -9,8 +9,8 @@ on:
       - 'charts/**'
 
 env:
-  HELM_VERSION: v3.4.0
-  HELM_GCS_VERSION: 0.3.20 # https://github.com/hayorov/helm-gcs
+  HELM_VERSION: v3.22.1
+  HELM_GCS_VERSION: 0.7.0 # https://github.com/hayorov/helm-gcs
   BUCKET_NAME: helm.sourcegraph.com
   BUCKET_PATH: insiders
 
@@ -20,17 +20,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Install Helm
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@v5
         with:
           version: ${{ env.HELM_VERSION }}
 
       - name: Configure gcloud
-        uses: google-github-actions/auth@v0
+        uses: google-github-actions/auth@v3
         with:
           credentials_json: ${{ secrets.GOOGLE_CLOUD_CREDENTIALS }}
           service_account: 'github-bot@sourcegraph-helm.iam.gserviceaccount.com'

.github/workflows/gcs_chart_publish_release.yml

@@ -17,8 +17,8 @@ on:
         required: false
 
 env:
-  HELM_VERSION: v3.4.0
-  HELM_GCS_VERSION: 0.3.20 # https://github.com/hayorov/helm-gcs
+  HELM_VERSION: v3.22.1
+  HELM_GCS_VERSION: 0.7.0 # https://github.com/hayorov/helm-gcs
   BUCKET_NAME: helm.sourcegraph.com
   BUCKET_PATH: release
 
@@ -29,24 +29,24 @@ jobs:
     steps:
       - name: Checkout
         if: ${{ inputs.ref == '' }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Checkout (break glass)
         if: ${{ inputs.ref != '' }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref }}
 
       - name: Install Helm
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@v5
         with:
           version: ${{ env.HELM_VERSION }}
 
       - name: Configure gcloud
-        uses: google-github-actions/auth@v0
+        uses: google-github-actions/auth@v3
         with:
           credentials_json: ${{ secrets.GOOGLE_CLOUD_CREDENTIALS }}
           service_account: 'github-bot@sourcegraph-helm.iam.gserviceaccount.com'

.github/workflows/helm_lint_test.yml

@@ -10,21 +10,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v5
         with:
-          version: v3.9.1
-      - uses: actions/setup-python@v5
+          version: v4.3.1
+      - uses: actions/setup-python@v7
         with:
-          python-version: '3.13'
-      - uses: azure/setup-kubectl@v2.0
+          python-version: '3.14'
+      - uses: azure/setup-kubectl@v5
         id: install
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.2.1
+        uses: helm/chart-testing-action@v2.9.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -39,7 +39,7 @@ jobs:
           echo $changed | xargs helm lint
         if: steps.list-changed.outputs.changed == 'true'
       - name: Create kind cluster
-        uses: helm/kind-action@v1.3.0
+        uses: helm/kind-action@v1.15.1
         if: steps.list-changed.outputs.changed == 'true'
       - name: Install Helm charts
         run: helm install --debug -f ./ci/override.yaml test-sg ./charts/sourcegraph/

.tool-versions

@@ -1 +1 @@
-github-cli 2.46.0
+github-cli 2.102.0

charts/sourcegraph-executor/dind/README.md

@@ -66,7 +66,7 @@ In addition to the documented values, the `executor` and `private-docker-registr
 | dind.gVisor.securityContext | object | `{"capabilities":{"add":["NET_ADMIN","SYS_ADMIN","AUDIT_WRITE","CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","MKNOD","NET_BIND_SERVICE","NET_RAW","SETFCAP","SETGID","SETPCAP","SETUID","SYS_CHROOT","SYS_PTRACE"]}}` | securityContext for the dind container when gVisor is enabled. Replaces privileged: true — gVisor intercepts these capabilities in-sandbox and never grants them to the host kernel. |
 | dind.image.registry | string | `"index.docker.io"` |  |
 | dind.image.repository | string | `"docker"` |  |
-| dind.image.tag | string | `"29.5.3-dind"` |  |
+| dind.image.tag | string | `"29.9.1-dind"` |  |
 | executor.env | object | `{}` | Extra environment variables to set on the executor container. |
 | executor.frontendExistingSecret | string | `""` | Name of existing k8s Secret to use for frontend password. The k8s Secret must contain the key EXECUTOR_FRONTEND_PASSWORD matching the site config executors.accessToken value. frontendPassword is ignored if this is set. |
 | executor.frontendPassword | string | `""` | The shared secret configured in the Sourcegraph instance site config under executors.accessToken. Required if frontendExistingSecret is not configured. |

charts/sourcegraph-executor/dind/values.yaml

@@ -138,7 +138,7 @@ dind:
   image:
     registry: index.docker.io
     repository: docker
-    tag: 29.5.3-dind
+    tag: 29.9.1-dind
   # -- Command for the dind container.
   command:
     - dockerd

dev/TODO.md

@@ -0,0 +1,7 @@
+# TODO
+
+- Move the chart publish workflows
+  (`.github/workflows/gcs_chart_publish_*.yml`) from Helm v3.22.1 to
+  Helm 4. helm-gcs 0.7.0 supports Helm 4 but installs a different
+  plugin layout and needs `--verify=false` on `helm plugin install`.
+  Buildkite CI and `helm_lint_test.yml` already run Helm 4.

scripts/ci/helm-unittest.sh

@@ -2,9 +2,7 @@
 
 set -euf -o pipefail
 
-# 1.0.3 is broken now
-# https://github.com/helm-unittest/helm-unittest/issues/790
-HELM_UNITTEST_VERSION="v1.0.2"
+HELM_UNITTEST_VERSION="v1.2.1"
 
 ### Install the helm-unittest plugin
 helm plugin install https://github.com/helm-unittest/helm-unittest --version "$HELM_UNITTEST_VERSION" --verify=false

scripts/ci/validate-schema.sh

@@ -3,7 +3,7 @@
 set -euf -o pipefail
 
 ### Install kubeval
-wget https://github.com/yannh/kubeconform/releases/download/v0.4.12/kubeconform-linux-amd64.tar.gz
+wget https://github.com/yannh/kubeconform/releases/download/v0.8.0/kubeconform-linux-amd64.tar.gz
 tar xf kubeconform-linux-amd64.tar.gz
 chmod +x kubeconform
 sudo cp kubeconform /usr/local/bin