chore: update dependencies

[marcleblanc2]

Summary

Bumps every pinned dependency in the repo to its current release. No chart template changes; the only chart-facing change is the executor dind sidecar image tag.

GitHub Actions

Action	Before	After
actions/checkout	v3 / v4	v7
actions/setup-python	v4 / v5	v7
github/codeql-action/upload-sarif	v3	v4
azure/setup-helm	v1 / v3	v5
azure/setup-kubectl	v2.0	v5
google-github-actions/auth	v0	v3
helm/chart-testing-action	v2.2.1	v2.9.0
helm/kind-action	v1.3.0	v1.15.1

Tool versions

Tool	Where	Before	After
Helm	gcs_chart_publish_*.yml	v3.4.0	v3.22.1
Helm	helm_lint_test.yml	v3.9.1	v4.3.1
helm-gcs	gcs_chart_publish_*.yml	0.3.20	0.7.0
helm-unittest	scripts/ci/helm-unittest.sh	v1.0.2	v1.2.1
kubeconform	scripts/ci/validate-schema.sh	v0.4.12	v0.8.0
github-cli	.tool-versions	2.46.0	2.102.0
Python	helm_lint_test.yml	3.13	3.14

Charts

Image	Before	After
executor dind docker	29.5.3-dind	29.9.1-dind

Already current, unchanged

helm-docs 1.14.2, comby 1.8.1, sourcegraph/backport@v2. Checkov stays on Python 3.12, the newest version checkov declares support for.

Decisions worth a look

• Publish workflows stay on Helm 3 (latest, v3.22.1), not Helm 4. The release path can't be exercised from a PR, and helm-gcs 0.7.0 installs a different plugin layout under Helm 4 (gcs + gcs-getter, needs --verify=false). Buildkite CI already installs Helm 4 unpinned from the Buildkite apt repo (4.3.0 today), and helm_lint_test.yml now runs Helm 4.3.1 too, so the charts get Helm 4 coverage on every PR. Tracked as a follow-up in dev/TODO.md.
• helm-unittest v1.0.2 → v1.2.1. The old comment pinned 1.0.2 because 1.0.3 broke helm plugin install (Error when installing via helm plugin install helm-unittest/helm-unittest#790). That issue is closed and the install hook's Linux path is plain GNU sha256sum -c --status.
• google-github-actions/auth@v3 still accepts credentials_json; service_account is only required for workload identity and is harmless alongside a JSON key.

Test plan

Run locally on macOS with Helm 4.3.0:

• helm unittest -q charts/sourcegraph with helm-unittest 1.2.1: 32 suites, 195 tests, 12 snapshots, all passed
• helm lint on all four charts: 0 failed
• kubeconform 0.8.0 -summary -strict on helm template output of all four charts: 81 resources valid, 0 invalid, 0 errors
• ./scripts/helm-docs.sh regenerated; only diff is the dind tag in charts/sourcegraph-executor/dind/README.md
• All new action tags resolve as git refs; helm-v3.22.1 and helm-v4.3.1 download from get.helm.sh
• Buildkite + helm_lint_test.yml on this PR exercise the Linux install paths for helm-unittest 1.2.1, kubeconform 0.8.0, and the bumped actions

[github-actions]

Open the Diff Tour for this PR in Sourcegraph