fix(ci): resolve lint and Helm fixture security failures

.github/linters/.checkov.yaml

@@ -0,0 +1,6 @@
+---
+quiet: true
+# Only the four upstream Valkey resources that inherit the Helm release namespace.
+# Chart install tests supply a dedicated namespace. Other namespace checks remain enabled.
+baseline: .github/linters/checkov-baseline.json
+output-baseline-as-skipped: true

.github/linters/.jscpd.json

@@ -1,4 +1,11 @@
 {
 	"threshold": 5,
-	"ignore": ["**/tests/**", "**/node_modules/**"]
+	"ignore": [
+		"**/tests/**",
+		".github/workflows/__test-*.yml",
+		"**/node_modules/**",
+		"**/package-lock.json",
+		"actions/**/README.md",
+		".github/workflows/*.md"
+	]
 }

.github/linters/checkov-baseline.json

@@ -0,0 +1,40 @@
+{
+	"failed_checks": [
+		{
+			"file": "/tests/charts/umbrella-application/test-umbrella-application/charts/database/templates/deploy_valkey.yaml",
+			"findings": [
+				{
+					"resource": "Deployment.default.database",
+					"check_ids": ["CKV_K8S_21"]
+				}
+			]
+		},
+		{
+			"file": "/tests/charts/umbrella-application/test-umbrella-application/charts/database/templates/service.yaml",
+			"findings": [
+				{
+					"resource": "Service.default.database",
+					"check_ids": ["CKV_K8S_21"]
+				}
+			]
+		},
+		{
+			"file": "/tests/charts/umbrella-application/test-umbrella-application/charts/database/templates/serviceaccount.yaml",
+			"findings": [
+				{
+					"resource": "ServiceAccount.default.database",
+					"check_ids": ["CKV_K8S_21"]
+				}
+			]
+		},
+		{
+			"file": "/tests/charts/umbrella-application/test-umbrella-application/charts/database/templates/init_config.yaml",
+			"findings": [
+				{
+					"resource": "ConfigMap.default.database-init-scripts",
+					"check_ids": ["CKV_K8S_21"]
+				}
+			]
+		}
+	]
+}

.trivyignore.yaml

@@ -1,30 +1,6 @@
 ---
 misconfigurations:
-  - id: KSV-0011
-    paths:
-      - "tests/charts/umbrella-application/charts/database/**"
-    statement: "Helm dependency alias path (database) is virtual and not a real workspace file."
-  - id: KSV-0015
-    paths:
-      - "tests/charts/umbrella-application/charts/database/**"
-    statement: "Helm dependency alias path (database) is virtual and not a real workspace file."
-  - id: KSV-0016
-    paths:
-      - "tests/charts/umbrella-application/charts/database/**"
-    statement: "Helm dependency alias path (database) is virtual and not a real workspace file."
-  - id: KSV-0018
-    paths:
-      - "tests/charts/umbrella-application/charts/database/**"
-    statement: "Helm dependency alias path (database) is virtual and not a real workspace file."
-  - id: KSV-0020
-    paths:
-      - "tests/charts/umbrella-application/charts/database/**"
-    statement: "Helm dependency alias path (database) is virtual and not a real workspace file."
-  - id: KSV-0021
-    paths:
-      - "tests/charts/umbrella-application/charts/database/**"
-    statement: "Helm dependency alias path (database) is virtual and not a real workspace file."
   - id: KSV-0110
     paths:
       - "tests/charts/umbrella-application/charts/database/**"
-    statement: "Helm dependency alias path (database) is virtual and not a real workspace file."
+    statement: "The upstream Valkey chart inherits the Helm release namespace; chart install tests set a dedicated namespace."

Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/hoverkraft-tech/docker-base-images/super-linter:0.4.0
+FROM ghcr.io/hoverkraft-tech/docker-base-images/super-linter:0.4.3
 
 HEALTHCHECK --interval=5m --timeout=10s --start-period=30s --retries=3 CMD ["/bin/sh","-c","test -d /github/home"]
 ARG UID=1000

actions/helm/generate-docs/action.yml

@@ -248,6 +248,8 @@ runs:
       with:
         client-id: ${{ inputs.github-app-client-id }}
         private-key: ${{ inputs.github-app-key }}
+        permission-contents: write
+        permission-pull-requests: write
 
     - uses: hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
       id: create-and-merge-pull-request

biome.json

@@ -3,6 +3,8 @@
 		"includes": [
 			"**",
 			"!.devcontainer/devcontainer-lock.json",
+			"!.github/logo.svg",
+			"!.github/social-preview.svg",
 			"!**/node_modules"
 		]
 	}