Update azure/setup-helm action from v4.2.0 to v4.3.0 (.github/workflows/test-helm-chart.yml)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
azure/setup-helm	action	minor	v4.2.0 -> v4.3.0

---

Release Notes

azure/setup-helm (azure/setup-helm)

v4.3.0

Compare Source

• #​152 feat: log when restoring from cache
• #​157 Dependencies Update
• #​137 Add dependabot

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dryrunsecurity]

DryRun Security Summary

The pull request updates GitHub Actions workflow files for DefectDojo's Helm chart processes, including version updates for azure/setup-helm actions, while containing potential security considerations related to authentication, Git credentials, and repository history exposure.

Expand for full summary

This PR updates GitHub Actions workflow files for DefectDojo's Helm chart release and testing processes, specifically updating azure/setup-helm action versions.

Security Findings:

1. Potential security considerations in release-x-manual-helm-chart.yml:

   • Uses GITHUB_TOKEN for authentication
   • Uses hardcoded Git username and email as environment variables
   • Checks out master branch with full history (fetch-depth: 0)
   • Workflow allows manual triggering with a release number input
   • Creates a draft release with the provided release number
   • Pushes changes to 'helm-charts' branch

2. Potential sensitive configuration in test-helm-chart.yml:

   • Fetch depth set to 0, which might expose full repository history

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved