feat(ci): self-test json-schema-validation against a fixture chart

.github/workflows/json-schema-validation.yaml

@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Run schemalint
         id: run-schemalint
         uses: giantswarm/schemalint/actions/verify-helm-schema@43a8314fa06020e2651cffc1617f5262b3d921a4 # v2.6.3
@@ -32,6 +34,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run helm-values-gen
         id: run-helm-values-gen

.github/workflows/selftest-json-schema-validation.yaml

@@ -0,0 +1,29 @@
+# Self-test for `json-schema-validation.yaml`.
+#
+# That workflow is consumed org-wide at `@main`, so a bad action pin merged here is live in
+# every cluster app repo within a minute. The repo's other checks are static (yamllint,
+# action-validator, zizmor) and cannot see a broken action: schemalint v2.6.2 changed its
+# release assets from tarballs to raw binaries, its action kept using install-binary-action's
+# default tarball URL, and the resulting 404 only surfaced in consumer repos.
+#
+# This calls the real reusable workflow against the fixture chart in `helm/`, so the action
+# pins under test are exactly the ones that ship - there is no second copy to drift.
+
+name: Self-test JSON schema validation
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/json-schema-validation.yaml'
+      - '.github/workflows/selftest-json-schema-validation.yaml'
+      - 'helm/**'
+  workflow_dispatch: {}
+
+permissions: {}
+
+jobs:
+  selftest:
+    name: Run json-schema-validation against the fixture chart
+    uses: ./.github/workflows/json-schema-validation.yaml
+    permissions:
+      contents: read

CHANGELOG.md

@@ -6,6 +6,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-08-05
+
+### Added
+
+- `selftest-json-schema-validation.yaml` — new check that runs `json-schema-validation.yaml` itself against a fixture chart in `helm/selftest-cluster-app/` on pull requests that touch it. Renovate bumping `verify-helm-schema` to v2.6.2 broke every cluster app repo because schemalint's release assets changed from tarballs to raw binaries while its action still requested the tarball URL; nothing here could catch that, since this repo is consumed at `@main` and its only checks are static.
+
+### Changed
+
+- `json-schema-validation.yaml` — both `actions/checkout` steps now set `persist-credentials: false`, per the repository's action rules. Neither job uses git.
 ## 2026-08-06
 
 ### Added

helm/selftest-cluster-app/README.md

@@ -0,0 +1,20 @@
+# Self-test fixture chart
+
+Not a real chart, and not published anywhere. This exists only so
+`.github/workflows/selftest-json-schema-validation.yaml` has something for
+`json-schema-validation.yaml` to run against on pull requests.
+
+Both composite actions that workflow calls locate their input with
+`find ./helm -maxdepth 2 -name values.schema.json`, and a `workflow_call` job cannot be given a
+working directory, so the fixture has to sit at the repository root under `helm/`.
+
+- `values.schema.json` — copied from schemalint's own
+  `pkg/lint/rulesets/testdata/cluster_azure.json` (its `rulesets_test.go` asserts zero errors
+  under the `cluster-app` rule set), then passed through `schemalint normalize`, which `verify`
+  also requires. The ~90 recommendations it reports are advisory and do not fail the run.
+- `values.yaml` — the exact stdout of `helm-values-gen values.schema.json`. The `generate` job
+  diffs the two, so regenerate this file whenever the schema changes:
+
+  ```bash
+  helm-values-gen helm/selftest-cluster-app/values.schema.json > helm/selftest-cluster-app/values.yaml
+  ```