fix(HELM): Add "artifacthub.io/changes" for renovate & dependabot

[kiblik]

• Run update as part of test GHA (to avoid "skipped action" to avoid user confusion)
  • Like https://github.com/DefectDojo/django-DefectDojo/actions/runs/18762609022/job/53530628933?pr=13519
• Add .annotations."artifacthub.io/changes" in helm/defectdojo/Chart.yaml with the same text as the title of the related PR.
  • Fix https://github.com/DefectDojo/django-DefectDojo/actions/runs/18579224104/job/52970701184

[dryrunsecurity]

This pull request contains a command injection vulnerability in the GitHub Actions workflow (.github/workflows/test-helm-chart.yml) where github.event.pull_request.title is interpolated into a shell run step and a malicious PR title with a single quote can break out of the quoted string to execute arbitrary commands on the runner; the existing if-condition does not reliably mitigate this because an attacker can craft a branch name from a fork to meet it. Fix by properly sanitizing or avoiding direct shell interpolation (use safe inputs, environment variables, or GitHub Actions toolkit commands).

Command Injection in GitHub Actions in .github/workflows/test-helm-chart.yml

Vulnerability

Command Injection in GitHub Actions

Description

The GitHub Actions workflow directly interpolates github.event.pull_request.title into a shell command within a run step. Although the string is single-quoted, a malicious pull request title containing a single quote character (') can break out of the quoted string, allowing an attacker to inject and execute arbitrary shell commands on the GitHub Actions runner. The if condition does not prevent exploitation, as an attacker can create a PR from a forked repository with a branch name matching the condition (e.g., renovate/malicious-branch).

django-DefectDojo/.github/workflows/test-helm-chart.yml

Lines 106 to 109 in f984d64

	yq -i '.annotations."artifacthub.io/changes" += "- kind: changed\n description: ${{ github.event.pull_request.title }}\n"' helm/defectdojo/Chart.yaml
	- name: Run helm-docs (update)
	uses: losisin/helm-docs-github-action@a57fae5676e4c55a228ea654a1bcaec8dd3cf5b5 # v1.6.2

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved