Fix config secret typo

.github/config.js

@@ -0,0 +1,41 @@
+module.exports = {
+  branchPrefix: 'test-renovate/',
+  username: 'renovate-release',
+  gitAuthor: 'Renovate Bot <bot@renovateapp.com>',
+  platform: 'github',
+  includeForks: true,
+  dryRun: null,
+  repositories: ['jessebot/vouch-helm-chart'],
+    extends: ['config:base', ':disableDependencyDashboard'],
+    allowPostUpgradeCommandTemplating: true,
+    allowedPostUpgradeCommands: ['^.*'],
+    regexManagers: [
+        {
+            fileMatch: ['(^|/)Chart\\.yaml$'],
+            matchStrings: [
+                '#\\s?renovate: image=(?<depName>.*?)\\s?appVersion:\\s?\\"?(?<currentValue>[\\w+\\.\\-]*)',
+            ],
+            datasourceTemplate: 'docker',
+        },
+    ],
+    packageRules: [
+        {
+            matchManagers: ['helm-requirements', 'helm-values', 'regex'],
+            postUpgradeTasks: {
+                commands: [
+                  `version=$(grep '^version:' {{{parentDir}}}/Chart.yaml | awk '{print $2}')
+                  major=$(echo $version | cut -d. -f1)
+                  minor=$(echo $version | cut -d. -f2)
+                  patch=$(echo $version | cut -d. -f3)
+                  minor=$(expr $minor + 1)
+                  echo "Replacing $version with $major.$minor.$patch"
+                  sed -i "s/^version:.*/version: $\{major\}.$\{minor\}.$\{patch\}/g" {{{parentDir}}}/Chart.yaml
+                  cat {{{parentDir}}}/Chart.yaml
+                  `,
+                ],
+            },
+            fileFilters: ['**/Chart.yaml'],
+            executionMode: 'branch',
+        },
+    ],
+};

.github/workflows/on-push.yaml → .github/workflows/cd-helm-release.yml

@@ -1,16 +1,21 @@
----
+name: Release
+
 on:
   push:
     branches:
-      - master
+      - main
+    paths:
+      - 'charts/**'
 
 jobs:
-  push-to-pages:
+  release:
+    environment: helm-release
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
@@ -20,11 +25,14 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Install Helm
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@v3.5
+        id: helm-install
         with:
-          version: v3.7.1
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.3.0
+        id: helm-release
+        uses: helm/chart-releaser-action@v1.5.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          CR_GENERATE_RELEASE_NOTES: true

.github/workflows/ci-helm-lint-test.yml

@@ -0,0 +1,49 @@
+name: Lint and Test Chart
+
+on:
+  pull_request:
+    paths:
+      - 'charts/**'
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: "0"
+
+      - name: Install Helm
+        uses: azure/setup-helm@v3.5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.4.0
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Run chart-testing (lint)
+        id: lint
+        if: steps.list-changed.outputs.changed == 'true'
+        run: ct lint --target-branch ${{ github.event.repository.default_branch }}
+
+      - name: Create kind cluster
+        uses: helm/kind-action@v1.8.0
+        if: steps.list-changed.outputs.changed == 'true'
+
+      - name: Run chart-testing (install)
+        id: install
+        if: steps.list-changed.outputs.changed == 'true'
+        run: ct install --target-branch ${{ github.event.repository.default_branch }} --helm-extra-args="--timeout 150s"

.github/workflows/renovatebot.yml

@@ -0,0 +1,20 @@
+name: Renovate - check for dependency updates
+on:
+  schedule:
+    # The "*" (#42, asterisk) character has special semantics in YAML, so this
+    # string has to be quoted.
+    - cron: '1 * * * *'
+
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v39.0.1
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+          configurationFile: .github/config.js

.pre-commit-config.yaml

@@ -0,0 +1,16 @@
+repos:
+  # update the chart README.md with the comments from values.yaml
+  - repo: https://github.com/norwoodj/helm-docs
+    rev: v1.2.0
+    hooks:
+      - id: helm-docs
+  # helm lint and markdown link verifier
+  - repo: https://github.com/gruntwork-io/pre-commit
+    rev: v0.1.22 # Get the latest from: https://github.com/gruntwork-io/pre-commit/releases
+    hooks:
+      - id: helmlint
+  # detect any secrets that may be committed before they're committed
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.17.0
+    hooks:
+      - id: gitleaks

CONTRIBUTING.md

@@ -0,0 +1,12 @@
+# To get started helping out
+Please install [pre-commit] and [helm-docs] locally and then install our pre-commit hooks.
+
+```bash
+pre-commit install
+pre-commit install-hooks
+```
+
+Right now, these just keep the docs up to date, but in the future, will provide other useful tools :)
+
+[pre-commit]: https://pre-commit.com/#install
+[helm-docs]: https://github.com/norwoodj/helm-docs#installation