[CI] re-enable linter (#30)

Author: jkroepke

.github/linters/.markdown-lint.yml

@@ -1,2 +1,14 @@
 MD013:
   line_length: 600
+MD060:
+  enabled: false
+MD022:
+  enabled: false
+MD031:
+  enabled: false
+MD032:
+  enabled: false
+MD033:
+  enabled: false
+MD034:
+  enabled: false

.github/linters/.textlintrc

@@ -0,0 +1,13 @@
+{
+  "filters": {
+    "comments": true,
+    "allowlist": {
+      "allow": [
+        "e-mail"
+      ]
+    }
+  },
+  "rules": {
+    "terminology": true
+  }
+}

.github/workflows/ci.yaml

@@ -17,6 +17,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
@@ -77,6 +78,8 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: generate CODEOWNERS
         run: |
@@ -103,29 +106,34 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Lint Code Base
         uses: super-linter/super-linter/slim@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          LINTER_RULES_PATH: .github/linters
           MULTI_STATUS: false
+          LINTER_RULES_PATH: .github/linters
+          ENABLE_GITHUB_ACTIONS_STEP_SUMMARY: true
+          ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: false
+          SAVE_SUPER_LINTER_SUMMARY: true
           VALIDATE_ALL_CODEBASE: false
           VALIDATE_BASH: true
           VALIDATE_BASH_EXEC: true
-          # VALIDATE_CHECKOV: true - always scans everything and all charts have too much errors
           VALIDATE_EDITORCONFIG: true
           VALIDATE_ENV: true
           VALIDATE_GITHUB_ACTIONS: true
+          VALIDATE_GITHUB_ACTIONS_ZIZMOR: true
           VALIDATE_GITLEAKS: true
+          VALIDATE_HTML: true
           VALIDATE_JSON: true
-          # VALIDATE_MARKDOWN: true #TODO: fix lint issues
-          # VALIDATE_NATURAL_LANGUAGE: true #TODO: fix lint issues
-          VALIDATE_PYTHON: true
-          VALIDATE_RENOVATE: true # does not support newest renovate config
+          VALIDATE_NATURAL_LANGUAGE: true
+          # VALIDATE_MARKDOWN: true - disable to for now.
+          VALIDATE_RENOVATE: true
           VALIDATE_SHELL_SHFMT: true
-          VALIDATE_XML: true
+          # VALIDATE_XML: true
+          # VALIDATE_YAML: true
   validate-pr:
     name: Validate PR Metadata
     runs-on: ubuntu-24.04
@@ -210,7 +218,7 @@ jobs:
     if: >-
       github.event.pull_request.head.repo.full_name == github.repository
       && contains(github.event.pull_request.labels.*.name, 'dependencies/auto-merge')
-      && (github.actor == 'renovate[bot]' || github.actor == 'mend[bot]' || github.actor == 'helm-charts-renovate-helper[bot]')
+      && (github.event.pull_request.user.login  == 'renovate[bot]' || github.event.pull_request.user.login  == 'helm-charts-renovate-helper-app[bot]')
     steps:
       # Using a GitHub App token, because GitHub Actions doesn't run on commits from github-actions bot
       # Used App:

.github/workflows/release.yaml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Fetch history
         run: git fetch --prune --unshallow

.github/workflows/renovate-custom-hooks.yaml

@@ -1,5 +1,7 @@
 name: renovate hooks
 
+permissions: {}
+
 on:
   pull_request:
     branches:
@@ -10,11 +12,14 @@ on:
 jobs:
   renovate-post-run:
     name: Renovate Post Run
-    runs-on: ubuntu-latest
-    if: github.actor == 'renovate[bot]' || github.actor == 'mend[bot]'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    if: github.event.pull_request.user.login  == 'renovate[bot]'
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       # Using a GitHub App token, because GitHub Actions doesn't run on commits from github-actions bot

.github/workflows/sync-readme.yaml

@@ -15,10 +15,13 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - run: |
           cp -f README.md ${{ runner.temp }}/README.md
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: true
           ref: gh-pages
       - run: |
           cp -f ${{ runner.temp }}/README.md .

CONTRIBUTING.md

@@ -36,7 +36,7 @@ See `git help commit`:
 * Must pass [DCO check](#sign-off-your-work)
 * Must follow [Charts best practices](https://helm.sh/docs/topics/chart_best_practices/)
 * Must pass CI jobs for linting and installing changed charts with the [chart-testing](https://github.com/helm/chart-testing) tool
-* Any change to a chart requires a version bump following [semver](https://semver.org/) principles. See [Immutability](#immutability) and [Versioning](#versioning) below
+* Any change to a chart requires a version bump following [SemVer](https://semver.org/) principles. See [Immutability](#immutability) and [Versioning](#versioning) below
 
 Once changes have been merged, the release job will automatically run to package and release changed charts.
 
@@ -46,14 +46,14 @@ Chart releases must be immutable. Any change to a chart warrants a chart version
 
 ### Versioning
 
-The chart `version` should follow [semver](https://semver.org/).
+The chart `version` should follow [SemVer](https://semver.org/).
 
 Charts should start at `1.0.0`. Any breaking (backwards incompatible) changes to a chart should:
 
 1. Bump the MAJOR version
-2. In the README, under a section called "Upgrading", describe the manual steps necessary to upgrade to the new (specified) MAJOR version
+2. In the readme, under a section called "Upgrading", describe the manual steps necessary to upgrade to the new (specified) MAJOR version
 
-### Generate README
+### Generate readme
 
 The readme of each chart can be re-generated with the following command (run inside the chart directory):
 

PROCESSES.md

@@ -23,7 +23,7 @@ maintainers:
   url:    # The URL of the GitHub profile, using the format https://github.com/<username>. Required.
 ```
 
-### Community admins (including repo admins)
+### Community admins (including repository admins)
 
 Chart admins are responsible for managing the repository (for example: housekeeping and adding new chart maintainers).
 They are also the point of contact for existing chart maintainers.

README.md

@@ -11,15 +11,15 @@ The code is provided as-is with no warranties.
 [Helm](https://helm.sh) must be installed to use the charts.
 Please refer to Helm's [documentation](https://helm.sh/docs/) to get started.
 
-Once Helm is set up properly, add the repo as follows:
+Once Helm is set up properly, add the repository as follows:
 
 ```console
 helm repo add grafana-community https://grafana-community.github.io/helm-charts
 ```
 
 You can then run `helm search repo grafana-community` to see the charts.
 
-<!-- Keep full URL links to repo files because this README syncs from main to gh-pages.  -->
+<!-- Keep full URL links to repository files because this README syncs from main to gh-pages.  -->
 Chart documentation is available in [grafana directory](https://github.com/grafana-community/helm-charts/blob/main/charts/grafana/README.md).
 
 **OCI artifacts of all Grafana Community Helm charts are available in [ghcr.io](https://github.com/orgs/grafana-community/packages?repo_name=helm-charts).**