helm charts: merge master into helm-charts branch

[valentijnscholten]

This PR merges the master branch into the helm-charts while making sure the helm chart files are all preserved including their history/commits.

The reason for this PR being so big is that the helm-chart diverted from master in 2017. I think it's good to do this merge to make the helm-charts branch more in sync with master. Maybe at some point we need to add a step to the release process to this "merge back" after every release (unless we split off the helm-chart into its own repo).

With this branch checked out the helm chart files look OK, as well as the history. Also the github workflows now have the current content, which is maybe the prime reason for this PR.

$cat helm/defectdojo/Chart.yaml

apiVersion: v2
appVersion: "2.54.0"
description: A Helm chart for Kubernetes to install DefectDojo
name: defectdojo
version: 1.9.6
icon: https://defectdojo.com/hubfs/DefectDojo_favicon.png
maintainers:
  - name: madchap
    email: [email protected]
    url: https://github.com/DefectDojo/django-DefectDojo
dependencies:
  - name: postgresql
    version: 16.7.27
    repository: "oci://us-docker.pkg.dev/os-public-container-registry/defectdojo"
    condition: postgresql.enabled
  - name: valkey
    version: 0.13.0
    repository: "oci://registry-1.docker.io/cloudpirates"
    condition: valkey.enabled
# For correct syntax, check https://artifacthub.io/docs/topics/annotations/helm/
# This is example for "artifacthub.io/changes"
# artifacthub.io/changes: |
#   - kind: added
#     description: Cool feature
#   - kind: fixed
#     description: Minor bug
#   - kind: changed
#     description: Broken feature
#   - kind: removed
#     description: Old bug
#   - kind: deprecated
#     description: Not-needed feature
#   - kind: security
#     description: Critical bug
annotations:
  artifacthub.io/prerelease: "false"
  artifacthub.io/changes: "- kind: changed\n  description: Bump DefectDojo to 2.54.0\n"

$ head -n 40 index.yaml

apiVersion: v1
entries:
  defectdojo:
  - annotations:
      artifacthub.io/changes: ""
      artifacthub.io/prerelease: "true"
    apiVersion: v2
    appVersion: 2.55.0-dev
    created: "2026-01-06T05:13:52.818181497Z"
    dependencies:
    - condition: postgresql.enabled
      name: postgresql
      repository: oci://us-docker.pkg.dev/os-public-container-registry/defectdojo
      version: 16.7.27
    - condition: valkey.enabled
      name: valkey
      repository: oci://registry-1.docker.io/cloudpirates
      version: 0.13.0
    description: A Helm chart for Kubernetes to install DefectDojo
    digest: 29da700bcec96e2c2dc0e812083b781540e226a58143c531559bf90e2a18f339
    icon: https://defectdojo.com/hubfs/DefectDojo_favicon.png
    maintainers:
    - email: [email protected]
      name: madchap
      url: https://github.com/DefectDojo/django-DefectDojo
    name: defectdojo
    urls:
    - https://github.com/DefectDojo/django-DefectDojo/releases/download/nightly-dev/defectdojo-1.9.7-dev.tgz
    version: 1.9.7-dev
  - annotations:
      artifacthub.io/changes: |
        - kind: changed
          description: Bump DefectDojo to 2.54.0
      artifacthub.io/prerelease: "false"
    apiVersion: v2
    appVersion: 2.54.0
    created: "2026-01-05T17:23:08.311468978Z"
    dependencies:
    - condition: postgresql.enabled
      name: postgresql

$git log --oneline helm

a69d0fe0cc (HEAD -> helm-charts-sync, origin/helm-charts-sync) Sync helm-charts with master (preserve index.yaml)
f1de10eae7 (upstream/release/2.54.0) Update versions in application files
3f764cc641 (upstream/master-into-dev/2.53.5-2.54.0-dev) Merge branch 'dev' into master-into-dev/2.53.5-2.54.0-dev
d799696d9f Update versions in application files
681114440a (upstream/release/2.53.5) Update versions in application files
cb61c593da (upstream-dev) fix(HELM): Docs after #13907 (#13942)
683ce9dd87 Update Helm chart docs
8e07e9a51f Merge branch 'dev' into master-into-dev/2.53.4-2.54.0-dev
5e4aaad066 Update versions in application files
e0d33041e9 (upstream/master-into-bugfix/2.53.4-2.54.0-dev) Update versions in application files
3688e2cf0d Update versions in application files
f87ffbdbaf feat(HELM): Make HPA more Argo-friendly (#13882)
a56e83227e chore(deps): update valkey docker tag from 0.10.2 to v0.13.0 (helm/defectdojo/chart.yaml) (#13907)
fcd0b4a9f5 Merge branch 'dev' into master-into-dev/2.53.3-2.54.0-dev
363e4bedb5 Update versions in application files
dd44020976 Update versions in application files
0e218499bc (upstream/release/2.53.3) Update versions in application files
7b73a29977 Merge branch 'dev' into master-into-dev/2.53.2-2.54.0-dev
c591357c85 Update versions in application files
33a25c859f Update versions in application files
7e4585dd96 (upstream/release/2.53.2) Updating helm deps
da66f9edd4 Update versions in application files
05ec7128bf fix(HELM): Annotation and docs correction for #22639 (#13878)
1d4d0dba08 fix(HELM): Use renovate-compatible format (#13866)
be68825b2c chore(deps): update gcr.io/cloudsql-docker/gce-proxy docker tag from 1.37.10 to v1.37.11 (helm/defectdojo/values.yaml) (#13856)
b1eb46f75e Update versions in application files
9fc3d88100 Update versions in application files
87ff93ad59 (upstream/release/2.53.1) Update versions in application files
6712a07ab5 fix(helm): Drop djnago.mediaPersistentVolume.fsGroup
532720e47b Update versions in application files
d3d64db241 (upstream/release/2.53.0) Update versions in application files
c4e1e02fbf feat(helm): Use Valkey (#13408)
a5dc94422e Update nginx/nginx-prometheus-exporter Docker tag from 1.4.2 to v1.5.1 (helm/defectdojo/values.yaml) (#13726)
75423ff439 Update gcr.io/cloudsql-docker/gce-proxy Docker tag from 1.37.9 to v1.37.10 (helm/defectdojo/values.yaml) (#13725)
21bf1a7fda Feat: Add HPA & PDB Helm Chart Support #13391 (#13512)
6f0897a0f6 Merge branch 'dev' into master-into-dev/2.52.2-2.53.0-dev
ed3719968e Update versions in application files
c1387b772e (upstream/release/2.52.2) Update versions in application files
5e9f1aed27 fix(helm): merge extraAnnotations with init job annotations (#13677)
b097ced6be feat(helm): Relocate docs/schema hints
c58f90e267 Update versions in application files
8daba95ab8 Update versions in application files
f4d4c41871 (upstream/release/2.52.1) Update versions in application files
e2dbca5482 fix(helm): Fix PVC templating after #13210 (#13619)
10dd753107 Update versions in application files
4b6ddca132 Update versions in application files
ea09b35bb3 feat(helm): Do not allow multiple celery beats (#13527)
0d7f0e0c9f feat(helm): Improve description about images/tags (#13473)
a1aa663c8d Merge branch 'dev' into master-into-dev/2.51.2-2.52.0-dev
70bba0cb1a Update versions in application files
969cb64b2f (upstream/release/2.51.2) Update versions in application files
47ac9339f8 feat(helm): Add descriptions (#13407)
6b17b5ed8a feat(helm): Split image locations+tags, allow digest pinning (#13370)
1d7ee8dcd5 fix(helm): Test oldest supported k8s version (#13376)

$ git log --oneline index.yaml
fb0bcf72e5 (upstream/helm-charts) Update index.yaml - nightly-dev
d012bd98b3 Update index.yaml - 2.54.0
5d348ce656 Update index.yaml - nightly-dev
598c99da27 Update index.yaml - nightly-dev
01269c553a Update index.yaml - nightly-dev
dee3c288fa Update index.yaml - nightly-dev
b72658a7bd Update index.yaml - nightly-dev
6bc6eea0cc Update index.yaml - nightly-dev
c6cb1fee85 Update index.yaml - nightly-dev
307331cc36 Update index.yaml - 2.53.5
e6fda3932a Update index.yaml - nightly-dev
e595216680 Update index.yaml - nightly-dev
dd4afbff6f Update index.yaml - nightly-dev
a464dc73d4 Update index.yaml - nightly-dev
554ccf7085 Update index.yaml - nightly-dev
c187197fa5 Update index.yaml - nightly-dev
bcb59029ba Update index.yaml - nightly-dev
015cf5d74e Update index.yaml - 2.53.4
4942080781 Update index.yaml - 2.53.4
bc4e2cddf5 Update index.yaml - 2.53.4
6f0d09e90c Update index.yaml - nightly-dev
be7b25526e Update index.yaml - nightly-dev
ef163f3f48 Update index.yaml - nightly-dev
497d7b8ae1 Update index.yaml - nightly-dev
876661382b Update index.yaml - nightly-dev
95414e6417 Update index.yaml - nightly-dev
ba0dc2e056 Update index.yaml - nightly-dev
aeab0fd7b4 Update index.yaml - 2.53.3
5a906c1b4e Update index.yaml - 2.53.2

This PR comes intead of #13425 which at the time of writing cannot be viewed on github.com. Maybe it's to big/complex or has too many conflicts?

[valentijnscholten]

wdyt @kiblik

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request includes repeated sensitive edits to docker/entrypoint-uwsgi.sh and workflow security issues: a JavaScript injection risk in .github/workflows/release-1-create-pr.yml due to insufficient validation of the NEW_BRANCH value, and shell/JavaScript injection risks in .github/workflows/release-3-master-into-dev.yml where unvalidated workflow_dispatch inputs can lead to arbitrary command or code execution with access to the runner and GITHUB_TOKEN.

🔴 Configured Codepaths Edit in docker/entrypoint-uwsgi.sh

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in docker/entrypoint-uwsgi.sh

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in docker/entrypoint-uwsgi.sh

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

JavaScript Injection in 'actions/github-script' in .github/workflows/release-1-create-pr.yml

Vulnerability

JavaScript Injection in 'actions/github-script'

Description

The 'NEW_BRANCH' environment variable is interpolated directly into a JavaScript string within an 'actions/github-script' block. This variable is derived from the 'release_number' input provided via 'workflow_dispatch'. While there are validation steps using 'grep' to check the format of 'release_number', this validation is insufficient because 'grep' returns a successful exit code if any line in a multiline input matches the pattern. An attacker can provide a multiline input where the first line passes validation and subsequent lines inject a malicious value for 'NEW_BRANCH' into the GITHUB_ENV file. When this value is interpolated into the JavaScript code, it allows for arbitrary code execution in the context of the runner, which has access to the GITHUB_TOKEN.

django-DefectDojo/.github/workflows/release-1-create-pr.yml

Lines 117 to 118 in b726042

	title: 'Release: Merge release into master from: ${{ env.NEW_BRANCH }}',
	body: `Release triggered by \`${ process.env.GITHUB_ACTOR }\``,

Shell and JavaScript Injection via Release Inputs in .github/workflows/release-3-master-into-dev.yml

Vulnerability

Shell and JavaScript Injection via Release Inputs

Description

The workflow 'release-3-master-into-dev.yml' uses 'workflow_dispatch' inputs 'release_number_new' and 'release_number_dev' directly in shell 'run' steps and 'github-script' blocks without any validation or sanitization. This allows an attacker with permission to trigger the workflow to execute arbitrary shell commands or JavaScript code in the context of the GitHub Actions runner. For example, providing a malicious string like 1.0.0"; touch /tmp/pwned; # as an input can lead to command execution. Similarly, in the 'github-script' step, inputs are interpolated into a JavaScript object literal, allowing for code injection that can exfiltrate secrets or perform unauthorized actions using the provided GITHUB_TOKEN.

django-DefectDojo/.github/workflows/release-3-master-into-dev.yml

Lines 49 to 52 in b726042

	sed -ri 's/__version__ = ".*"/__version__ = "${{ inputs.release_number_dev }}"/' dojo/__init__.py
	sed -ri 's/"version": ".*"/"version": "${{ inputs.release_number_dev }}"/' components/package.json
	sed -ri 's/appVersion: ".*"/appVersion: "${{ inputs.release_number_dev }}"/' helm/defectdojo/Chart.yaml
	CURRENT_CHART_VERSION=$(grep -oP 'version: (\K\S*)?' helm/defectdojo/Chart.yaml | head -1)

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[Maffooch]

Are unit tests expected to fail here?

[valentijnscholten]

I think because the branching point from master was so old, it doesn't pick up some of the workflows and some of them use old workflow definitions.

[Maffooch]

I'll be the last approver on Tuesday morining after the release from monday is out the door