feat: onboarding setup-helm action

.github/workflows/actions_release.yml

@@ -0,0 +1,27 @@
+name: Release GitHub Actions
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag for the release"
+        required: true
+      node_version:
+        description: "Node.js version"
+        required: false
+        default: "24"
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+
+    uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@v1
+    with:
+      tag: "${{ github.event.inputs.tag }}"
+      node_version: ${{ inputs.node_version || '24' }}

.github/workflows/audit_package.yml

@@ -0,0 +1,33 @@
+name: NPM Audit Fix Run
+
+on:
+  workflow_dispatch:
+    inputs:
+      force:
+        description: "Use --force flag for npm audit fix?"
+        required: true
+        type: boolean
+      base_branch:
+        description: "Specify a base branch"
+        required: false
+        default: "main"
+      node_version:
+        description: "Node.js version"
+        required: false
+        default: "24"
+  schedule:
+    - cron: "0 0 * * 1"
+
+jobs:
+  audit-fix:
+    uses: step-security/reusable-workflows/.github/workflows/audit_fix.yml@v1
+    with:
+      force: ${{ inputs.force || false }}
+      base_branch: ${{ inputs.base_branch || 'main' }}
+      node_version: ${{ inputs.node_version || '24' }}
+
+permissions:
+  contents: write
+  pull-requests: write
+  packages: read
+  issues: write

.github/workflows/auto_cherry_pick.yml

@@ -0,0 +1,42 @@
+name: Auto Cherry-Pick from Upstream
+
+on:
+  workflow_run:
+    workflows: [ "Release GitHub Actions" ]
+    types:
+      - completed
+
+  workflow_dispatch:
+    inputs:
+      base_branch:
+        description: "Base branch to create the PR against"
+        required: true
+        default: "main"
+      mode:
+        description: "Run mode: cherry-pick or verify"
+        required: false
+        default: "cherry-pick"
+      node_version:
+        description: "Node.js version"
+        required: false
+        default: "24"
+
+  pull_request:
+    types: [ opened, synchronize, labeled ]
+
+permissions:
+  contents: write
+  pull-requests: write
+  packages: read
+  issues: write
+
+jobs:
+  cherry-pick:
+    if: (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || github.event_name == 'workflow_dispatch' || contains(fromJson(toJson(github.event.pull_request.labels)).*.name, 'review-required')
+    uses: step-security/reusable-workflows/.github/workflows/auto_cherry_pick.yaml@v1
+    with:
+      original-owner: "azure"
+      repo-name: "setup-helm"
+      base_branch: ${{ inputs.base_branch || 'main' }}
+      mode: ${{ github.event_name == 'pull_request' && 'verify' || inputs.mode || 'cherry-pick' }}
+      node_version: ${{ inputs.node_version || '24' }}

.github/workflows/integration-tests.yml

@@ -0,0 +1,86 @@
+name: 'Trigger Integration tests'
+on:
+   pull_request:
+      branches:
+         - main
+jobs:
+   trigger-integration-tests:
+      name: Trigger Integration tests
+      strategy:
+         matrix:
+            os: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest", "ubuntu-24.04-arm"]') }}
+         fail-fast: false
+      runs-on: ${{ matrix.os }}
+      env:
+         HELM_3_18_4: 'v3.18.4'
+         HELM_3_18_0: 'v3.18.0'
+         HELM_NO_V: '3.18.4'
+         PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+      steps:
+         - name: Check out repository
+           uses: actions/checkout@v7
+         - name: npm install and build
+           id: action-npm-build
+           run: |
+              echo $PR_BASE_REF
+              if [[ $PR_BASE_REF != releases/* ]]; then
+                npm install
+                npm run build
+              fi
+         - name: Setup helm
+           uses: ./
+           with:
+              version: ${{ env.HELM_3_18_4 }}
+         - name: Validate helm 3.18.4
+           run: |
+              if [[ $(helm version) != *$HELM_3_18_4* ]]; then
+                echo "HELM VERSION INCORRECT: HELM VERSION DOES NOT CONTAIN v3.18.4"
+                echo "HELM VERSION OUTPUT: $(helm version)"
+                exit 1
+              else
+                echo "HELM VERSION $HELM_3_18_4 INSTALLED SUCCESSFULLY"
+              fi
+         - name: Setup helm 3.18.0
+           uses: ./
+           with:
+              version: ${{ env.HELM_3_18_0 }}
+         - name: Validate 3.18.0
+           run: |
+              if [[ $(helm version) != *$HELM_3_18_0* ]]; then
+                echo "HELM VERSION INCORRECT: HELM VERSION DOES NOT CONTAIN v3.18.0"
+                echo "HELM VERSION OUTPUT: $(helm version)"
+                exit 1
+              else
+                echo "HELM VERSION $HELM_3_18_0 INSTALLED SUCCESSFULLY"
+              fi
+         - name: Setup helm 3.18.4 with no v in version
+           uses: ./
+           with:
+              version: ${{ env.HELM_NO_V }}
+         - name: Validate 3.18.4 without v in version
+           run: |
+              if [[ $(helm version) != *$HELM_NO_V* ]]; then
+                echo "HELM VERSION INCORRECT: HELM VERSION DOES NOT CONTAIN 3.18.4"
+                echo "HELM VERSION OUTPUT: $(helm version)"
+                exit 1
+              else
+                echo "HELM VERSION $HELM_NO_V INSTALLED SUCCESSFULLY"
+              fi
+         - name: Setup helm latest version
+           uses: ./
+           with:
+              version: latest
+              token: ${{ secrets.GITHUB_TOKEN }}
+         - name: Validate latest
+           env:
+              GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+           run: |
+              HELM_LATEST=$(curl -s https://get.helm.sh/helm-latest-version)
+
+              if [[ $(helm version) != *$HELM_LATEST* ]]; then
+                echo "HELM VERSION INCORRECT: HELM VERSION DOES NOT CONTAIN $HELM_LATEST"
+                echo "HELM VERSION OUTPUT: $(helm version)"
+                exit 1
+              else
+                echo "HELM VERSION $HELM_LATEST INSTALLED SUCCESSFULLY"
+              fi

.github/workflows/prettify-code.yml

@@ -0,0 +1,16 @@
+name: 'Run prettify'
+on:
+   pull_request:
+   push:
+      branches: [main]
+
+jobs:
+   prettier:
+      name: Prettier Check
+      runs-on: ubuntu-latest
+      steps:
+         - name: Checkout Repository
+           uses: actions/checkout@v7
+
+         - name: Enforce Prettier
+           run: npx prettier --check .

.github/workflows/unit-tests.yml

@@ -0,0 +1,23 @@
+name: 'Run unit tests.'
+on: # rebuild any PRs and main branch changes
+   pull_request:
+      branches:
+         - main
+   push:
+      branches:
+         - main
+
+jobs:
+   build: # make sure build/ci works properly
+      strategy:
+         matrix:
+            os: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest", "ubuntu-24.04-arm", "windows-latest", "windows-11-arm" ]') }}
+         fail-fast: false
+      runs-on: ${{ matrix.os }}
+      steps:
+         - uses: actions/checkout@v7
+
+         - name: Run L0 tests.
+           run: |
+              npm install
+              npm test

.gitignore

@@ -0,0 +1,67 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# TypeScript v1 declaration files
+typings/
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variables file
+.env
+
+# next.js build output
+.next
+
+node_modules
+coverage
+
+# Planning docs
+docs/

.npmrc

@@ -0,0 +1 @@
+min-release-age=3

.prettierignore

@@ -0,0 +1,6 @@
+# dependencies
+/node_modules
+coverage
+/dist
+.github/workflows
+.pre-commit-config.yaml

.prettierrc.json

@@ -0,0 +1,8 @@
+{
+   "trailingComma": "none",
+   "bracketSpacing": false,
+   "semi": false,
+   "tabWidth": 3,
+   "singleQuote": true,
+   "printWidth": 80
+}

LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) Microsoft Corporation.
+Copyright (c) 2026 StepSecurity
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

README.md

@@ -1 +1,39 @@
-# setup-helm
+[![StepSecurity Maintained Action](https://raw.githubusercontent.com/step-security/maintained-actions-assets/main/assets/maintained-action-banner.png)](https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions)
+
+# Setup Helm
+
+Install a specific version of helm binary on the runner.
+
+## Example
+
+Acceptable values are latest or any semantic version string like v3.5.0 Use this action in workflow to define which version of helm will be used. v2+ of this action only support Helm3.
+
+```yaml
+- uses: step-security/setup-helm@v5
+  with:
+     version: '<version>' # default is latest (stable)
+  id: install
+```
+
+Alternatively, the version can be read from a [`.tool-versions`](https://asdf-vm.com/manage/configuration.html) file (the format used by [asdf](https://asdf-vm.com/) and [mise](https://mise.jdx.dev/)) via the `version-file` input:
+
+```yaml
+- uses: step-security/setup-helm@v5
+  with:
+     version-file: .tool-versions
+  id: install
+```
+
+The action reads the version declared for the `helm` tool, for example:
+
+```
+helm 3.18.4
+```
+
+If both `version` and `version-file` are set, an explicitly requested `version` takes precedence and `version-file` is ignored (a warning is emitted). Because `version` defaults to `latest`, `version-file` is only ignored when you set `version` to a specific value other than `latest`; if `version` is left at its default, the version from `version-file` is used.
+
+> [!NOTE]
+> If something goes wrong with fetching the latest version the action will use the hardcoded default version (currently v3.18.4). If you rely on a certain version higher than the default, you should explicitly use that version instead of latest.
+
+The cached helm binary path is prepended to the PATH environment variable as well as stored in the helm-path output variable.
+Refer to the action metadata file for details about all the inputs https://github.com/step-security/setup-helm/blob/main/action.yml

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities to security@stepsecurity.io