Clear the remaining zizmor findings in helm-publish

[ChrisJBurns]

First of the follow-ups to #6274, which makes the zizmor check blocking at medium. This clears the low and informational findings in one of the four release workflows so the threshold can eventually go lower.

Summary

• All nine template-injection findings and both artipacked findings in helm-publish.yml are cleared — 11 → 0. Every expression in a run: block is now bound through env:.
• Be clear about what this is and is not. None of these values can carry a shell metacharacter: the version derives from the tag, the rest are matrix entries and a repository name, which GitHub restricts to [A-Za-z0-9._-]. The genuinely reachable sinks in this file — the GHCR credentials and the unquoted helm package --version — were fixed in Bind the GHCR credentials and chart version in helm-publish #6270. This is consistency, not a fix.

It is worth doing now because the file is otherwise clean, so keeping it that way is cheap; and because leaving nine findings in place is what stops the gate dropping below medium later.

Shape

• Matrix and repository values move to a job-level env: — they are constant across the job, so binding them once beats repeating them in six steps.
• CHART_VERSION stays per-step, because job-level env: cannot read a step output. That is the one asymmetry and it is deliberate.
• $REGISTRY is referenced directly; it is already a workflow-level env: and so already in every step's shell.
• Both checkouts get persist-credentials: false.

Test plan

• Unit tests (task test)

• E2E tests (task test-e2e)

• Linting (task lint-fix)

• Manual testing (describe below)

• Checked every shell variable in every step resolves. Wrote a check that collects each step's available names — workflow env:, job env:, step env:, locally assigned, and the GitHub-provided ones — against every $VAR it references. No step references anything undefined.

• Checked the artifact name still lines up. helm package writes ${CHART_NAME}-${CHART_VERSION}.tgz and helm push reads exactly that string; both now resolve from the same two variables rather than from re-interpolated expressions.

• Confirmed neither job can push — verify-tag and publish-helm both declare contents: read — so persist-credentials: false cannot break anything.

• Workflow parses as YAML; actionlint clean; zizmor reports no findings at all for this file.

This cannot be verified before merge. helm-publish.yml is workflow_call only, invoked from releaser.yml on release: published, and it runs after the image push — a failure leaves images in GHCR and charts not. That risk has not changed; what has changed is that it is now being taken for tidiness rather than for a fix, which is worth weighing.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Does this introduce a user-facing change?

No.

Special notes for reviewers

• If you would rather not take release-workflow churn for findings that cannot be exploited, this is the PR to decline. The alternative is leaving the gate at medium permanently, which is a perfectly good place for it. Make the zizmor check blocking #6274 stands on its own either way.
• The Package Helm chart step keeps only CHART_VERSION in its env: — CHART_PATH and CHART_NAME now come from the job — so that step's diff looks like a deletion. It is not losing anything.
• Best merged just after a release rather than just before.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.76%. Comparing base (06483ba) to head (da77878).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6275      +/-   ##
==========================================
+ Coverage   72.73%   72.76%   +0.02%     
==========================================
  Files         742      742              
  Lines       77299    77299              
==========================================
+ Hits        56224    56244      +20     
+ Misses      17113    17076      -37     
- Partials     3962     3979      +17     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ChrisJBurns]

/retest