fix(helm/dependabot/renovate): Fix broken automatic update

[kiblik]

Finish #13520
Fix #13530 & #13612
GHA is failing because action wasn't initialized correctly (https://github.com/DefectDojo/django-DefectDojo/actions/runs/19070470968/job/54486644356#step:4:21) - it needs to be checked out on the branch.

[dryrunsecurity]

This pull request contains a workflow that checks out and runs code from the pull request head (github.event.pull_request.head.repo/full_name and ref), allowing untrusted forked PRs to execute arbitrary code in the CI environment and potentially exfiltrate GITHUB_TOKEN or other secrets. This is a high-risk workflow pattern and should be changed to avoid running untrusted code from forks, for example by restricting actions, using pull_request_target carefully, or requiring maintainer-reviewed workflows.

Arbitrary Code Execution in GitHub Actions from Forked Repository in .github/workflows/test-helm-chart.yml

Vulnerability

Arbitrary Code Execution in GitHub Actions from Forked Repository

Description

The GitHub Actions workflow uses actions/checkout to retrieve code from github.event.pull_request.head.repo.full_name and github.event.pull_request.head.ref. This means the workflow checks out and executes code directly from the head of a pull request, which can originate from an untrusted forked repository. An attacker can submit a pull request with malicious code, which will then be executed within the workflow's context, potentially leading to exfiltration of the GITHUB_TOKEN or other secrets, or injection of malicious artifacts.

django-DefectDojo/.github/workflows/test-helm-chart.yml

Lines 110 to 112 in 218e263

	with:
	repository: ${{ github.event.pull_request.head.repo.full_name }}
	ref: ${{ github.event.pull_request.head.ref }}

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved