helm/helm: zero-width spaces in a doc comment

Line 80 of Helm's internal/plugin/plugin.go, a doc comment on the characters allowed in plugin names, hides three zero-width spaces around _ and -. The go ruleset flags them because such characters can hide what code does; here they may be deliberate. This config was written to test alint; Helm doesn't use alint.

What alint found

.alint.yml

extends:
  - alint://bundled/go@v1

✗ error go-sources-no-zero-width

internal/plugin/plugin.go, line 80: three zero-width spaces (U+200B) around _ and - in the doc comment on plugin names. A question for the maintainers rather than a bug.

The config

Helm is one Go module of about 540 Go files, and its conventions live in project files: OWNERS, .goreleaser.yaml, a KEYS file and an adopters list. The config checks the Apache header on Go and shell files, the formatter settings and version pins, the structure of OWNERS and .goreleaser.yaml, and the DCO sign-off on pull request commits. golangci-lint, gofmt, go mod tidy and govulncheck run from command_idempotent rules.

.alint.yml

- id: helm-go-version-sync
  kind: cross_file_value_equals
  source:
    file: ".github/env"
    extract:
      regex: '(?m)^GOLANG_VERSION=(?P<value>\d+\.\d+)'
  targets:
    - file: "go.mod"
      extract:
        regex: '(?m)^go (?P<value>\d+\.\d+)'
  level: warning

CI reads the Go version from .github/env; go.mod declares its own. This rule keeps them equal.

.alint.yml

- id: helm-golangci-linters-sorted
  # fixed here: markers are whole lines, not patterns
  kind: ordered_block
  paths: ".golangci.yml"
  start: "enable:"
  end: "exclusions:"
  level: warning

.golangci.yml asks for its linter list to stay sorted, in a comment. ordered_block checks each enable: list up to the exclusions: line after it, which covers the formatters too.

.alint.yml

- id: helm-import-firewall
  kind: import_gate
  language: go
  paths:
    include: ["**/*.go"]
    exclude:
      - "**/testdata/**"
      - "internal/third_party/**"
  forbid: '^(github\.com/hashicorp/go-multierror|github\.com/pkg/errors|github\.com/evanphx/json-patch)$'
  level: error

depguard's and gomodguard's bans, as one import_gate rule: no go-multierror, pkg/errors or json-patch.

What stays outside alint

Go analysis, security scans and releases stay where they are:

the 19 golangci-lint linters, which analyze Go code;
CodeQL, OpenSSF Scorecard and govulncheck, which run as GitHub workflows;
release semantics and signing in goreleaser and cosign.