From e009003ffa65f66afb03144bd531fda1ff43ce3e Mon Sep 17 00:00:00 2001
From: Rasheed Amir <rasheed@stakater.com>
Date: Fri, 22 May 2026 18:50:43 +0200
Subject: [PATCH 1/7] harden actions

---
 .github/actions/loadtest/action.yml           | 25 ++++++++-----
 .github/workflows/init-branch-release.yaml    |  4 +--
 .github/workflows/loadtest.yml                | 14 ++++----
 .github/workflows/pull_request-helm.yaml      | 15 ++++----
 .github/workflows/pull_request.yaml           | 28 ++++++++-------
 .github/workflows/push-helm-chart.yaml        | 21 ++++++-----
 .github/workflows/push-pr-image.yaml          | 18 +++++-----
 .github/workflows/push.yaml                   | 35 +++++++++----------
 .github/workflows/release-helm-chart.yaml     |  4 +--
 .github/workflows/release.yaml                | 35 +++++++++----------
 .../reloader-enterprise-published.yml         |  9 ++++-
 .../reloader-enterprise-unpublished.yml       |  9 ++++-
 12 files changed, 125 insertions(+), 92 deletions(-)

diff --git a/.github/actions/loadtest/action.yml b/.github/actions/loadtest/action.yml
index 3f71ae9f..164056d6 100644
--- a/.github/actions/loadtest/action.yml
+++ b/.github/actions/loadtest/action.yml
@@ -209,12 +209,21 @@ runs:
     - name: Post PR comment
       if: inputs.post-comment == 'true' && inputs.pr-number != ''
       continue-on-error: true
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+      # Untrusted/templated values are passed via env and read with process.env
+      # inside the script, so they are never interpolated into JS source.
+      env:
+        SUMMARY_PATH: ${{ github.workspace }}/test/loadtest/summary.md
+        COMMENT_HEADER: ${{ inputs.comment-header }}
+        RUN_STATUS: ${{ steps.run.outputs.status }}
+        TEST_TYPE: ${{ inputs.test-type }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
       with:
         github-token: ${{ inputs.github-token }}
         script: |
           const fs = require('fs');
-          const summaryPath = '${{ github.workspace }}/test/loadtest/summary.md';
+          const summaryPath = process.env.SUMMARY_PATH;
           let summary = 'No results available';
           try {
             summary = fs.readFileSync(summaryPath, 'utf8');
@@ -222,24 +231,24 @@ runs:
             console.log('Could not read summary file:', e.message);
           }
 
-          const header = '${{ inputs.comment-header }}';
-          const status = '${{ steps.run.outputs.status }}';
+          const header = process.env.COMMENT_HEADER;
+          const status = process.env.RUN_STATUS;
           const statusEmoji = status === 'pass' ? ':white_check_mark:' : ':x:';
 
           const body = [
-            header ? header : `## ${statusEmoji} Load Test Results (${{ inputs.test-type }})`,
+            header ? header : `## ${statusEmoji} Load Test Results (${process.env.TEST_TYPE})`,
             '',
             summary,
             '',
             '---',
-            `**Artifacts:** [Download](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})`,
+            `**Artifacts:** [Download](${process.env.RUN_URL})`,
           ].join('\n');
 
           try {
             await github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              issue_number: ${{ inputs.pr-number }},
+              issue_number: Number(process.env.PR_NUMBER),
               body: body
             });
             console.log('Comment posted successfully');
@@ -252,7 +261,7 @@ runs:
           }
 
     - name: Upload results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       if: always()
       with:
         name: loadtest-${{ inputs.test-type }}-results
diff --git a/.github/workflows/init-branch-release.yaml b/.github/workflows/init-branch-release.yaml
index 01c54dca..cd37bd2a 100644
--- a/.github/workflows/init-branch-release.yaml
+++ b/.github/workflows/init-branch-release.yaml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -57,7 +57,7 @@ jobs:
           git diff
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v7.0.8
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           commit-message: "Bump version to ${{ inputs.TARGET_VERSION }}"
           title: "Bump version to ${{ inputs.TARGET_VERSION }} on ${{ inputs.TARGET_BRANCH }} branch"
diff --git a/.github/workflows/loadtest.yml b/.github/workflows/loadtest.yml
index dbe5d9cd..03270645 100644
--- a/.github/workflows/loadtest.yml
+++ b/.github/workflows/loadtest.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Add reaction to comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -31,7 +31,7 @@ jobs:
 
       - name: Get PR details
         id: pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const pr = await github.rest.pulls.get({
@@ -46,19 +46,19 @@ jobs:
             console.log(`PR #${context.issue.number}: ${pr.data.head.ref} -> ${pr.data.base.ref}`);
 
       - name: Checkout PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ steps.pr.outputs.head_sha }}
           fetch-depth: 0  # Full history for building from base ref
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: '1.26'
           cache: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Install kind
         run: |
@@ -89,7 +89,7 @@ jobs:
 
       - name: Add success reaction
         if: steps.loadtest.outputs.status == 'pass'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -101,7 +101,7 @@ jobs:
 
       - name: Add failure reaction
         if: steps.loadtest.outputs.status == 'fail'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
diff --git a/.github/workflows/pull_request-helm.yaml b/.github/workflows/pull_request-helm.yaml
index 0edafae8..f4f6e067 100644
--- a/.github/workflows/pull_request-helm.yaml
+++ b/.github/workflows/pull_request-helm.yaml
@@ -14,6 +14,9 @@ env:
   KIND_VERSION: "0.23.0"
   REGISTRY: ghcr.io
 
+# Default to no GITHUB_TOKEN permissions; each job opts into the minimum it needs.
+permissions: {}
+
 jobs:
 
   helm-chart-validation:
@@ -26,19 +29,19 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v5
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       with:
         ref: ${{github.event.pull_request.head.sha}}
         fetch-depth: 0
 
     # Setting up helm binary
     - name: Set up Helm
-      uses: azure/setup-helm@v4
+      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
       with:
         version: v3.11.3
 
     - name: Helm chart unit tests
-      uses: d3adb5/helm-unittest-action@v2
+      uses: d3adb5/helm-unittest-action@850bc76597579183998069830d5fa8c3ef0ea34a # v2
       with:
         charts: deployments/kubernetes/chart/reloader
 
@@ -55,7 +58,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v5
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       with:
         ref: ${{github.event.pull_request.head.sha}}
         fetch-depth: 0
@@ -71,13 +74,13 @@ jobs:
         echo "CURRENT_CHART_VERSION=$(echo ${current_chart_version})" >> $GITHUB_OUTPUT
 
     - name: Get Updated Chart version from Chart.yaml
-      uses: mikefarah/yq@master
+      uses: mikefarah/yq@751d8ad57b84f1794661bc70c0afb92a22ad7b3c # v4.53.2
       id: new_chart_version
       with:
         cmd: yq e '.version' deployments/kubernetes/chart/reloader/Chart.yaml
 
     - name: Check Version
-      uses: aleoyakas/check-semver-increased-action@v1
+      uses: aleoyakas/check-semver-increased-action@415c9c60054c2442c03478b6dd96a195deac6695 # v1
       id: check-version
       with:
         current-version: ${{ steps.new_chart_version.outputs.result }}
diff --git a/.github/workflows/pull_request.yaml b/.github/workflows/pull_request.yaml
index ad121532..e55be6e8 100644
--- a/.github/workflows/pull_request.yaml
+++ b/.github/workflows/pull_request.yaml
@@ -19,9 +19,15 @@ env:
   REGISTRY: ghcr.io
   RELOADER_EDITION: oss
 
+# Default to no GITHUB_TOKEN permissions; each job opts into the minimum it needs.
+permissions: {}
+
 jobs:
   qa:
-    uses: stakater/.github/.github/workflows/pull_request_doc_qa.yaml@v0.0.163
+    permissions:
+      contents: read
+      pull-requests: write # reusable workflow posts languagetool review comments
+    uses: stakater/.github/.github/workflows/pull_request_doc_qa.yaml@3dfb835dba6b596fe32e1d0f5eadbb4a3a139a1c # v0.0.163
     with:
       MD_CONFIG: .github/md_config.json
       DOC_SRC: README.md
@@ -38,30 +44,30 @@ jobs:
     name: Build
     steps:
     - name: Check out code
-      uses: actions/checkout@v5
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       with:
         ref: ${{github.event.pull_request.head.sha}}
         fetch-depth: 0
 
     # Setting up helm binary
     - name: Set up Helm
-      uses: azure/setup-helm@v5
+      uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
       with:
         version: v3.20.2
 
     - name: Helm chart unit tests
-      uses: d3adb5/helm-unittest-action@v2
+      uses: d3adb5/helm-unittest-action@850bc76597579183998069830d5fa8c3ef0ea34a # v2
       with:
         charts: deployments/kubernetes/chart/reloader
         helm-version: v3.20.2
         github-token: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
       with:
         go-version-file: 'go.mod'
         check-latest: true
-        cache: true
+        cache: false
 
     - name: Create timestamp
       id: prep
@@ -130,10 +136,10 @@ jobs:
         echo "GIT_UBI_TAG=$(echo ${ubi_tag})" >> $GITHUB_OUTPUT
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
     - name: Generate image repository path for ghcr registry
       run: |
@@ -142,7 +148,7 @@ jobs:
     # To identify any broken changes in dockerfiles or dependencies
 
     - name: Build Docker Image
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
       with:
         context: .
         file: ${{ env.DOCKER_FILE_PATH  }}
@@ -155,7 +161,6 @@ jobs:
           EDITION=${{ env.RELOADER_EDITION }}
           BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }}
         
-        cache-to: type=inline
         platforms: linux/amd64,linux/arm,linux/arm64
         tags: |
           ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.GIT_TAG }}
@@ -165,7 +170,7 @@ jobs:
           org.opencontainers.image.revision=${{ github.sha }}
 
     - name: Build Docker UBI Image
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
       with:
         context: .
         file: ${{ env.DOCKER_UBI_FILE_PATH  }}
@@ -178,7 +183,6 @@ jobs:
           EDITION=${{ env.RELOADER_EDITION }}
           BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }}
           BUILDER_IMAGE=${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.highest_tag.outputs.tag }}
-        cache-to: type=inline
         platforms: linux/amd64,linux/arm64
         tags: |
           ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.GIT_UBI_TAG }}
diff --git a/.github/workflows/push-helm-chart.yaml b/.github/workflows/push-helm-chart.yaml
index fc80c05e..eab327e0 100644
--- a/.github/workflows/push-helm-chart.yaml
+++ b/.github/workflows/push-helm-chart.yaml
@@ -17,6 +17,9 @@ env:
   HELM_REGISTRY_URL: "https://stakater.github.io/stakater-charts"
   REGISTRY: ghcr.io # container registry
 
+# Default to no GITHUB_TOKEN permissions; each job opts into the minimum it needs.
+permissions: {}
+
 jobs:
   verify-and-push-helm-chart:
 
@@ -31,7 +34,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           token: ${{ secrets.PUBLISH_TOKEN }}
           fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
@@ -39,7 +42,7 @@ jobs:
 
       # Setting up helm binary
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           version: v3.11.3
 
@@ -54,13 +57,13 @@ jobs:
           echo "CURRENT_CHART_VERSION=$(echo ${current_chart_version})" >> $GITHUB_OUTPUT
 
       - name: Get Updated Chart version from Chart.yaml
-        uses: mikefarah/yq@master
+        uses: mikefarah/yq@751d8ad57b84f1794661bc70c0afb92a22ad7b3c # v4.53.2
         id: new_chart_version
         with:
           cmd: yq e '.version' deployments/kubernetes/chart/reloader/Chart.yaml
 
       - name: Check Version
-        uses: aleoyakas/check-semver-increased-action@v1
+        uses: aleoyakas/check-semver-increased-action@415c9c60054c2442c03478b6dd96a195deac6695 # v1
         id: check-version
         with:
           current-version: ${{ steps.new_chart_version.outputs.result }}
@@ -73,10 +76,10 @@ jobs:
           exit 1
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4.0.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Login to GHCR Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: stakater-user
@@ -92,7 +95,7 @@ jobs:
         run: cosign sign --yes ghcr.io/stakater/charts/reloader:${{ steps.new_chart_version.outputs.result }}
 
       - name: Publish Helm chart to gh-pages
-        uses: stefanprodan/helm-gh-pages@master
+        uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0
         with:
           branch: master
           repository: stakater-charts
@@ -106,14 +109,14 @@ jobs:
           commit_email: stakater@gmail.com
 
       - name: Push new chart tag
-        uses: anothrNick/github-tag-action@1.75.0
+        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0
         env:
           GITHUB_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
           WITH_V: false
           CUSTOM_TAG: chart-v${{ steps.new_chart_version.outputs.result }}
 
       - name: Notify Slack
-        uses: 8398a7/action-slack@v3
+        uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3
         if: always() # Pick up events even if the job fails or is canceled.
         with:
           status: ${{ job.status }}
diff --git a/.github/workflows/push-pr-image.yaml b/.github/workflows/push-pr-image.yaml
index 9d8681ce..88259b87 100644
--- a/.github/workflows/push-pr-image.yaml
+++ b/.github/workflows/push-pr-image.yaml
@@ -14,6 +14,9 @@ env:
   DOCKER_FILE_PATH: Dockerfile
   REGISTRY: ghcr.io
 
+# Default to no GITHUB_TOKEN permissions; each job opts into the minimum it needs.
+permissions: {}
+
 jobs:
 
   build-and-push-pr-image:
@@ -25,17 +28,17 @@ jobs:
     if: ${{ github.event.label.name == 'build-and-push-pr-image' }}
     steps:
     - name: Check out code
-      uses: actions/checkout@v5
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       with:
         ref: ${{github.event.pull_request.head.sha}}
         fetch-depth: 0
 
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
       with:
         go-version-file: 'go.mod'
         check-latest: true
-        cache: true
+        cache: false
 
     - name: Install Dependencies
       run: |
@@ -52,31 +55,30 @@ jobs:
         echo "GIT_TAG=$(echo ${tag})" >> $GITHUB_OUTPUT
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
     - name: Generate image repository path for ghcr registry
       run: |
         echo GHCR_IMAGE_REPOSITORY=${{env.REGISTRY}}/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
 
     - name: Login to ghcr registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ${{env.REGISTRY}}
         username: stakater-user
         password: ${{secrets.GITHUB_TOKEN}}
 
     - name: Build Docker Image
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
       with:
         context: .
         file: ${{ env.DOCKER_FILE_PATH  }}
         pull: true
         push: true
         build-args: BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }}
-        cache-to: type=inline
         platforms: linux/amd64,linux/arm,linux/arm64
         tags: |
           ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.GIT_TAG }}
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index b7908bf9..6e7e3346 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -17,6 +17,9 @@ env:
   REGISTRY: ghcr.io
   RELOADER_EDITION: oss
 
+# Default to no GITHUB_TOKEN permissions; each job opts into the minimum it needs.
+permissions: {}
+
 jobs:
   build:
 
@@ -30,7 +33,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           token: ${{ secrets.PUBLISH_TOKEN }}
           fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
@@ -38,16 +41,16 @@ jobs:
 
       # Setting up helm binary
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           version: v3.11.3
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: 'go.mod'
           check-latest: true
-          cache: true
+          cache: false
 
       - name: Install Dependencies
         run: |
@@ -78,13 +81,13 @@ jobs:
         run: make test
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to Docker Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.STAKATER_DOCKERHUB_USERNAME }}
           password: ${{ secrets.STAKATER_DOCKERHUB_PASSWORD }}
@@ -98,7 +101,7 @@ jobs:
           echo DOCKER_IMAGE_REPOSITORY=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
 
       - name: Build and Push Docker Image to Docker registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ${{ env.DOCKER_FILE_PATH  }}
@@ -110,7 +113,6 @@ jobs:
             BUILD_DATE=${{ steps.prep.outputs.created }}
             EDITION=${{ env.RELOADER_EDITION }}
             BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }}
-          cache-to: type=inline
           platforms: linux/amd64,linux/arm,linux/arm64
           tags: |
             ${{ env.DOCKER_IMAGE_REPOSITORY }}:merge-${{ github.event.number }}
@@ -119,7 +121,7 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Build and Push Docker UBI Image to Docker registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ${{ env.DOCKER_UBI_FILE_PATH  }}
@@ -128,7 +130,6 @@ jobs:
           build-args: |
             BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }}
             BUILDER_IMAGE=${{ env.DOCKER_IMAGE_REPOSITORY }}:merge-${{ github.event.number }}
-          cache-to: type=inline
           platforms: linux/amd64,linux/arm64
           tags: |
             ${{ env.DOCKER_IMAGE_REPOSITORY }}:merge-${{ github.event.number }}-ubi
@@ -137,7 +138,7 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Login to ghcr registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{env.REGISTRY}}
           username: stakater-user
@@ -148,7 +149,7 @@ jobs:
           echo GHCR_IMAGE_REPOSITORY=${{env.REGISTRY}}/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
 
       - name: Build and Push Docker Image to ghcr registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ${{ env.DOCKER_FILE_PATH  }}
@@ -160,7 +161,6 @@ jobs:
             BUILD_DATE=${{ steps.prep.outputs.created }}
             EDITION=${{ env.RELOADER_EDITION }}
             BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }}
-          cache-to: type=inline
           platforms: linux/amd64,linux/arm,linux/arm64
           tags: |
             ${{ env.GHCR_IMAGE_REPOSITORY }}:merge-${{ github.event.number }}
@@ -169,7 +169,7 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Build and Push Docker UBI Image to ghcr registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ${{ env.DOCKER_UBI_FILE_PATH  }}
@@ -178,7 +178,6 @@ jobs:
           build-args: |
             BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }}
             BUILDER_IMAGE=${{ env.GHCR_IMAGE_REPOSITORY }}:merge-${{ github.event.number }}
-          cache-to: type=inline
           platforms: linux/amd64,linux/arm64
           tags: |
             ${{ env.GHCR_IMAGE_REPOSITORY }}:merge-${{ github.event.number }}-ubi
@@ -187,14 +186,14 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Push Latest Tag
-        uses: anothrNick/github-tag-action@1.75.0
+        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0
         env:
           GITHUB_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
           WITH_V: false
           CUSTOM_TAG: merge-${{ github.event.number }}
 
       - name: Notify Slack
-        uses: 8398a7/action-slack@v3
+        uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3
         if: always() # Pick up events even if the job fails or is canceled.
         with:
           status: ${{ job.status }}
diff --git a/.github/workflows/release-helm-chart.yaml b/.github/workflows/release-helm-chart.yaml
index 78c70636..afc39ee5 100644
--- a/.github/workflows/release-helm-chart.yaml
+++ b/.github/workflows/release-helm-chart.yaml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
 
@@ -30,7 +30,7 @@ jobs:
               --generate-notes
 
       - name: Notify Slack
-        uses: 8398a7/action-slack@v3
+        uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3
         if: always()
         with:
           status: ${{ job.status }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fac3fe72..f84be902 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -13,6 +13,9 @@ env:
   REGISTRY: ghcr.io
   RELOADER_EDITION: oss
 
+# Default to no GITHUB_TOKEN permissions; each job opts into the minimum it needs.
+permissions: {}
+
 jobs:
   release:
 
@@ -25,7 +28,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           token: ${{ secrets.PUBLISH_TOKEN }}
           fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
@@ -33,16 +36,16 @@ jobs:
 
       # Setting up helm binary
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           version: v3.11.3
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: 'go.mod'
           check-latest: true
-          cache: true
+          cache: false
 
       - name: Install Dependencies
         run: |
@@ -81,13 +84,13 @@ jobs:
         run: echo "created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to Docker Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.STAKATER_DOCKERHUB_USERNAME }}
           password: ${{ secrets.STAKATER_DOCKERHUB_PASSWORD }}
@@ -97,13 +100,12 @@ jobs:
           echo DOCKER_IMAGE_REPOSITORY=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
 
       - name: Build and Push Docker Image to Docker registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ${{ env.DOCKER_FILE_PATH  }}
           pull: true
           push: true
-          cache-to: type=inline
           platforms: linux/amd64,linux/arm,linux/arm64
           tags: |
             ${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }}
@@ -118,7 +120,7 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Build and Push Docker UBI Image to Docker registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ${{ env.DOCKER_UBI_FILE_PATH  }}
@@ -126,7 +128,6 @@ jobs:
           push: true
           build-args: |
             BUILDER_IMAGE=${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }}
-          cache-to: type=inline
           platforms: linux/amd64,linux/arm64
           tags: |
             ${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }}-ubi
@@ -136,7 +137,7 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Login to ghcr registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{env.REGISTRY}}
           username: stakater-user
@@ -148,13 +149,12 @@ jobs:
 
       # tag this image as latest as it will be used in plain manifests
       - name: Build and Push Docker Image to ghcr registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ${{ env.DOCKER_FILE_PATH  }}
           pull: true
           push: true
-          cache-to: type=inline
           platforms: linux/amd64,linux/arm,linux/arm64
           tags: |
             ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }},${{ env.GHCR_IMAGE_REPOSITORY }}:latest
@@ -169,7 +169,7 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Build and Push Docker UBI Image to ghcr registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ${{ env.DOCKER_UBI_FILE_PATH  }}
@@ -177,7 +177,6 @@ jobs:
           push: true
           build-args: |
             BUILDER_IMAGE=${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }}
-          cache-to: type=inline
           platforms: linux/amd64,linux/arm64
           tags: |
             ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }}-ubi
@@ -191,7 +190,7 @@ jobs:
       ##############################
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@master
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           version: latest
           args: release --clean
@@ -199,7 +198,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
 
       - name: Notify Slack
-        uses: 8398a7/action-slack@v3
+        uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3
         if: always() # Pick up events even if the job fails or is canceled.
         with:
           status: ${{ job.status }}
diff --git a/.github/workflows/reloader-enterprise-published.yml b/.github/workflows/reloader-enterprise-published.yml
index 9015c2c0..6d092154 100644
--- a/.github/workflows/reloader-enterprise-published.yml
+++ b/.github/workflows/reloader-enterprise-published.yml
@@ -4,14 +4,21 @@ on:
   release:
     types: [published]
 
+# Authenticates with a PAT, not GITHUB_TOKEN — no token scopes needed.
+permissions: {}
+
 jobs:
   dispatch:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger target repository workflow
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
+          payload=$(jq -nc --arg tag "$RELEASE_TAG" \
+            '{event_type: "release-published", client_payload: {tag: $tag}}')
           curl -X POST \
           -H "Accept: application/vnd.github.v3+json" \
           -H "Authorization: token ${{ secrets.STAKATER_AB_TOKEN_FOR_RLDR }}" \
           https://api.github.com/repos/stakater-ab/reloader-enterprise/dispatches \
-          -d '{"event_type":"release-published","client_payload":{"tag":"${{ github.event.release.tag_name }}"}}'
+          -d "$payload"
diff --git a/.github/workflows/reloader-enterprise-unpublished.yml b/.github/workflows/reloader-enterprise-unpublished.yml
index e1d6743f..99274789 100644
--- a/.github/workflows/reloader-enterprise-unpublished.yml
+++ b/.github/workflows/reloader-enterprise-unpublished.yml
@@ -4,14 +4,21 @@ on:
   release:
     types: [unpublished ]
 
+# Authenticates with a PAT, not GITHUB_TOKEN — no token scopes needed.
+permissions: {}
+
 jobs:
   dispatch:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger target repository workflow
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
+          payload=$(jq -nc --arg tag "$RELEASE_TAG" \
+            '{event_type: "release-unpublished", client_payload: {tag: $tag}}')
           curl -X POST \
           -H "Accept: application/vnd.github.v3+json" \
           -H "Authorization: token ${{ secrets.STAKATER_AB_TOKEN_FOR_RLDR }}" \
           https://api.github.com/repos/stakater-ab/reloader-enterprise/dispatches \
-          -d '{"event_type":"release-unpublished","client_payload":{"tag":"${{ github.event.release.tag_name }}"}}'
+          -d "$payload"

From af018af95c03162b4addb18fbaacafd4b1aa053a Mon Sep 17 00:00:00 2001
From: Safwan <msafwankarim786@gmail.com>
Date: Mon, 25 May 2026 10:04:35 +0500
Subject: [PATCH 2/7] bump vulnerable go dependency

---
 go.mod | 10 +++++-----
 go.sum | 16 ++++++++--------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/go.mod b/go.mod
index b3182dab..cb3d8670 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/stakater/Reloader
 
-go 1.26.2
+go 1.26.3
 
 require (
 	github.com/argoproj/argo-rollouts v1.9.0
@@ -62,11 +62,11 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/term v0.41.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/term v0.43.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
diff --git a/go.sum b/go.sum
index 70a4505f..db6c2011 100644
--- a/go.sum
+++ b/go.sum
@@ -147,8 +147,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -157,14 +157,14 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

From 977b24b77119b34d6b725523e404a151e7ac2939 Mon Sep 17 00:00:00 2001
From: Safwan <msafwankarim786@gmail.com>
Date: Mon, 25 May 2026 11:16:05 +0500
Subject: [PATCH 3/7] updated docker go version

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index f92fa5eb..e76b396c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@ ARG BUILDER_IMAGE
 ARG BASE_IMAGE
 
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM} ${BUILDER_IMAGE:-golang:1.26.2} AS builder
+FROM --platform=${BUILDPLATFORM} ${BUILDER_IMAGE:-golang:1.26} AS builder
 
 ARG TARGETOS
 ARG TARGETARCH

From 7644e514f3b387735d693c1ffcb8ace057bf3a2e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 25 May 2026 07:14:30 +0000
Subject: [PATCH 4/7] Update registry.access.redhat.com/ubi9/ubi Docker tag to
 v9.8-1779374378

---
 Dockerfile.ubi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile.ubi b/Dockerfile.ubi
index d7416432..ba22ebba 100644
--- a/Dockerfile.ubi
+++ b/Dockerfile.ubi
@@ -3,7 +3,7 @@ ARG BASE_IMAGE
 
 FROM --platform=${BUILDPLATFORM} ${BUILDER_IMAGE} AS SRC
 
-FROM ${BASE_IMAGE:-registry.access.redhat.com/ubi9/ubi:9.7} AS ubi
+FROM ${BASE_IMAGE:-registry.access.redhat.com/ubi9/ubi:9.8-1779374378} AS ubi
 ARG TARGETARCH
 
 

From d633294d755ce11c70c17793e817d6322012aba0 Mon Sep 17 00:00:00 2001
From: Safwan <msafwankarim786@gmail.com>
Date: Mon, 25 May 2026 13:35:01 +0500
Subject: [PATCH 5/7] updated helm version

---
 .github/workflows/pull_request-helm.yaml          | 2 +-
 .github/workflows/push-helm-chart.yaml            | 2 +-
 .github/workflows/push.yaml                       | 2 +-
 .github/workflows/release.yaml                    | 2 +-
 deployments/kubernetes/chart/reloader/Chart.yaml  | 4 ++--
 deployments/kubernetes/chart/reloader/values.yaml | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/pull_request-helm.yaml b/.github/workflows/pull_request-helm.yaml
index f4f6e067..8b78df06 100644
--- a/.github/workflows/pull_request-helm.yaml
+++ b/.github/workflows/pull_request-helm.yaml
@@ -38,7 +38,7 @@ jobs:
     - name: Set up Helm
       uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
       with:
-        version: v3.11.3
+        version: v3.20.2
 
     - name: Helm chart unit tests
       uses: d3adb5/helm-unittest-action@850bc76597579183998069830d5fa8c3ef0ea34a # v2
diff --git a/.github/workflows/push-helm-chart.yaml b/.github/workflows/push-helm-chart.yaml
index eab327e0..29b52580 100644
--- a/.github/workflows/push-helm-chart.yaml
+++ b/.github/workflows/push-helm-chart.yaml
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
-          version: v3.11.3
+          version: v3.20.2
 
       - name: Add Stakater Helm Repo
         run: |
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 6e7e3346..7f2f76ed 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -43,7 +43,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
-          version: v3.11.3
+          version: v3.20.2
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f84be902..ee1154b6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -38,7 +38,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
-          version: v3.11.3
+          version: v3.20.2
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
diff --git a/deployments/kubernetes/chart/reloader/Chart.yaml b/deployments/kubernetes/chart/reloader/Chart.yaml
index 3d2f447f..ee8bae06 100644
--- a/deployments/kubernetes/chart/reloader/Chart.yaml
+++ b/deployments/kubernetes/chart/reloader/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v1
 name: reloader
 description: Reloader chart that runs on kubernetes
-version: 2.2.11
-appVersion: v1.4.16
+version: 2.2.12
+appVersion: v1.4.17
 keywords:
   - Reloader
   - kubernetes
diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml
index 03429366..c764c765 100644
--- a/deployments/kubernetes/chart/reloader/values.yaml
+++ b/deployments/kubernetes/chart/reloader/values.yaml
@@ -19,7 +19,7 @@ fullnameOverride: ""
 image:
   name: stakater/reloader
   repository: ghcr.io/stakater/reloader
-  tag: v1.4.16
+  tag: v1.4.17
   # digest: sha256:1234567
   pullPolicy: IfNotPresent
 

From c4df6404c3abf0205dbd5aaee801eb9ddd51bda6 Mon Sep 17 00:00:00 2001
From: Safwan <msafwankarim786@gmail.com>
Date: Mon, 25 May 2026 13:39:52 +0500
Subject: [PATCH 6/7] add helm version in pr workflow

---
 .github/workflows/pull_request-helm.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/pull_request-helm.yaml b/.github/workflows/pull_request-helm.yaml
index 8b78df06..3cb5482f 100644
--- a/.github/workflows/pull_request-helm.yaml
+++ b/.github/workflows/pull_request-helm.yaml
@@ -44,6 +44,8 @@ jobs:
       uses: d3adb5/helm-unittest-action@850bc76597579183998069830d5fa8c3ef0ea34a # v2
       with:
         charts: deployments/kubernetes/chart/reloader
+        helm-version: v3.20.2
+        github-token: ${{ secrets.GITHUB_TOKEN }}
 
   helm-version-validation:
     needs: helm-chart-validation

From 500c2e57cb6ed40fa116eb2e39a07030e4afed3b Mon Sep 17 00:00:00 2001
From: t3mi <t3mi@users.noreply.github.com>
Date: Mon, 20 Apr 2026 12:12:07 +0000
Subject: [PATCH 7/7] feat(helm): add support for enabling user namespace

Signed-off-by: t3mi <t3mi@users.noreply.github.com>
---
 deployments/kubernetes/chart/reloader/README.md                | 1 +
 .../kubernetes/chart/reloader/templates/deployment.yaml        | 3 +++
 deployments/kubernetes/chart/reloader/values.yaml              | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/deployments/kubernetes/chart/reloader/README.md b/deployments/kubernetes/chart/reloader/README.md
index d72cec45..3e7df648 100644
--- a/deployments/kubernetes/chart/reloader/README.md
+++ b/deployments/kubernetes/chart/reloader/README.md
@@ -75,6 +75,7 @@ helm uninstall {{RELEASE_NAME}} -n {{NAMESPACE}}
 | ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ----------------- |
 | `reloader.deployment.replicas`                  | Number of replicas, if you wish to run multiple replicas set `reloader.enableHA = true`. The replicas will be limited to 1 when `reloader.enableHA = false` | int    | 1                 |
 | `reloader.deployment.revisionHistoryLimit`      | Limit the number of revisions retained in the revision history                                                                                              | int    | 2                 |
+| `reloader.deployment.hostUsers`                 | Enable user namespace                                                                                                       | boolean    |               |
 | `reloader.deployment.nodeSelector`              | Scheduling pod to a specific node based on set labels                                                                                                       | map    | `{}`              |
 | `reloader.deployment.affinity`                  | Set affinity rules on pod                                                                                                                                   | map    | `{}`              |
 | `reloader.deployment.securityContext`           | Set pod security context                                                                                                                                    | map    | `{}`              |
diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
index e568f9fd..b4c1796d 100644
--- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
@@ -47,6 +47,9 @@ spec:
       {{- if .Values.global.imagePullSecrets }}
       imagePullSecrets:
 {{ include "reloader-imagePullSecrets" . | indent 8 }}
+      {{- end }}
+      {{- if kindIs "bool" .Values.reloader.deployment.hostUsers }}
+      hostUsers: {{ .Values.reloader.deployment.hostUsers }}
       {{- end }}
       {{- if .Values.reloader.deployment.nodeSelector }}
       nodeSelector:
diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml
index c764c765..7e3c0c5c 100644
--- a/deployments/kubernetes/chart/reloader/values.yaml
+++ b/deployments/kubernetes/chart/reloader/values.yaml
@@ -78,6 +78,8 @@ reloader:
 
     revisionHistoryLimit: 2
 
+    hostUsers: null
+
     nodeSelector:
     # cloud.google.com/gke-nodepool: default-pool