From 7d678ddc8fcc8f075b275807c7388e8e070266b7 Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Fri, 24 Jul 2026 15:34:14 +0000
Subject: [PATCH 1/3] ci: validate Flint kube-linter support Signed-off-by:
 Gregor Zeitlinger <gregor.zeitlinger@grafana.com>

---
 .github/config/flint.toml          |  6 +++++-
 .github/config/kube-linter.yaml    | 10 ++++++++++
 .github/renovate-tracked-deps.json |  3 ++-
 mise.toml                          |  3 ++-
 4 files changed, 19 insertions(+), 3 deletions(-)
 create mode 100644 .github/config/kube-linter.yaml

diff --git a/.github/config/flint.toml b/.github/config/flint.toml
index 9fb622f1..aef4312a 100644
--- a/.github/config/flint.toml
+++ b/.github/config/flint.toml
@@ -1,5 +1,9 @@
 [settings]
-exclude = ["**/package-lock.json"]
+exclude = [
+  "**/package-lock.json",
+  # actionlint 1.7.12 predates GitHub's environment.deployment setting.
+  ".github/workflows/ghcr-image-build-and-publish.yml",
+]
 
 [checks.renovate-deps]
 exclude_managers = ["github-actions", "github-runners"]
diff --git a/.github/config/kube-linter.yaml b/.github/config/kube-linter.yaml
new file mode 100644
index 00000000..2dfb4745
--- /dev/null
+++ b/.github/config/kube-linter.yaml
@@ -0,0 +1,10 @@
+checks:
+  # k8s/lgtm.yaml is intentionally a development and demo deployment. It follows the
+  # image's `latest` release, uses its default user and writable paths, and leaves resource
+  # sizing to the user.
+  exclude:
+    - latest-tag
+    - no-read-only-root-fs
+    - run-as-non-root
+    - unset-cpu-requirements
+    - unset-memory-requirements
diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index 3b55dd7a..87d515cd 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -313,12 +313,13 @@
     "mise.toml": {
       "mise": [
         "actionlint",
-        "aqua:grafana/flint",
         "aqua:grafana/oats",
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
+        "aqua:stackrox/kube-linter",
         "bats",
         "biome",
+        "cargo:https://github.com/grafana/flint",
         "dotnet",
         "editorconfig-checker",
         "go",
diff --git a/mise.toml b/mise.toml
index 8e1f568e..9bb0c99b 100644
--- a/mise.toml
+++ b/mise.toml
@@ -10,10 +10,11 @@ rust = { version = "1.97.1", components = "clippy,rustfmt" }
 
 # Linters
 actionlint = "1.7.12"
-"aqua:grafana/flint" = "0.22.6"
 "aqua:jonwiggins/xmloxide" = "0.4.3"
 "aqua:owenlamont/ryl" = "0.21.0"
+"aqua:stackrox/kube-linter" = "0.8.3"
 biome = "2.5.2"
+"cargo:https://github.com/grafana/flint" = "rev:f68039f"
 editorconfig-checker = "3.8.0"
 golangci-lint = "2.12.2"
 google-java-format = "1.35.0"

From f3fe863e90c2bda1ad315b09daa26960dced02a6 Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 12:17:39 +0000
Subject: [PATCH 2/3] ci: keep release workflow in Flint scope

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 .github/config/flint.toml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/config/flint.toml b/.github/config/flint.toml
index aef4312a..9fb622f1 100644
--- a/.github/config/flint.toml
+++ b/.github/config/flint.toml
@@ -1,9 +1,5 @@
 [settings]
-exclude = [
-  "**/package-lock.json",
-  # actionlint 1.7.12 predates GitHub's environment.deployment setting.
-  ".github/workflows/ghcr-image-build-and-publish.yml",
-]
+exclude = ["**/package-lock.json"]
 
 [checks.renovate-deps]
 exclude_managers = ["github-actions", "github-runners"]

From 8a9d230c61d44137d8becbd05dfb778a06bed9f4 Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 13:00:32 +0000
Subject: [PATCH 3/3] ci: use the kube-linter mise entry Signed-off-by: Gregor
 Zeitlinger <gregor.zeitlinger@grafana.com>

---
 .github/renovate-tracked-deps.json | 2 +-
 mise.toml                          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index 682e284a..4bac614b 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -318,7 +318,6 @@
         "aqua:grafana/oats",
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
-        "aqua:stackrox/kube-linter",
         "bats",
         "biome",
         "dotnet",
@@ -328,6 +327,7 @@
         "google-java-format",
         "hadolint",
         "java",
+        "kube-linter",
         "lychee",
         "node",
         "npm:renovate",
diff --git a/mise.toml b/mise.toml
index fc66b4bd..38277c3f 100644
--- a/mise.toml
+++ b/mise.toml
@@ -2,7 +2,6 @@
 [tools]
 "aqua:grafana/gcx" = "v0.6.0"
 "aqua:grafana/oats" = "0.8.0"
-"aqua:stackrox/kube-linter" = "0.8.3"
 bats = "1.14.0"
 dotnet = "10.0.202"
 go = "1.26.5"
@@ -20,6 +19,7 @@ editorconfig-checker = "3.8.0"
 golangci-lint = "2.12.2"
 google-java-format = "1.35.0"
 hadolint = "2.14.0"
+kube-linter = "0.8.3"
 lychee = "0.24.2"
 # @yarnpkg/libzip 3.2.2 is npm-signed and matches Yarn's release commit, but
 # was published without provenance; mise's no-downgrade policy otherwise rejects Renovate.