upsteam fixes.

[jwitrick]

What this PR does / why we need it:

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #

Special notes for your reviewer:

PR Readiness Checklist:

Complete these before marking the PR as ready to review:

• the CHANGELOG.md release notes have been updated to reflect any significant (and particularly user-facing) changes introduced by this PR

[Copilot]

Pull request overview

Updates the noop backend behavior to allow successful decrypt operations, and aligns tests, docs, and CI tooling versions with upstream changes.

Changes:

• Make the noop backend treat files as “encrypted” and implement passthrough decrypt/copy behavior.
• Update unit tests to expect successful noop decrypt with plaintext output.
• Bump versions and pinned commits across docs, submodules, and GitHub Actions workflows.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
scripts/lib/backends/noop.sh	Implements noop encrypt/decrypt behavior and encryption checks.
tests/unit/secret-backends.bats	Adjusts noop backend tests to assert success and plaintext output.
CHANGELOG.md	Adds 4.7.5 release notes and updates compare links.
docs/Installation.md	Updates documented helm-secrets plugin version.
docs/ArgoCD Integration.md	Updates example tool versions for ArgoCD integration.
tests/bats/extensions/bats-file	Updates submodule commit pointer.
tests/bats/core	Updates submodule commit pointer.
.github/workflows/ci.yaml	Updates tool versions and pinned GitHub Actions versions.
.github/workflows/release.yaml	Updates pinned actions/checkout and create-pull-request versions.
.github/workflows/wiki.yaml	Updates pinned actions/checkout version.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

When input is - (stdin) and an output path is provided, this implementation ignores output and always writes to stdout (cat). If callers expect decrypt - - /path/to/out to write to a file, this will misbehave. Consider branching on both input == '-' and whether output is set, e.g. cat >\"${output}\" when output is non-empty.

[Copilot]

The step name says 'Setup Ruby 3.0' but the configured version is 4.0.1. Please update the step name to match the actual Ruby version (or adjust the version if the label is intended).

Suggested change

	- name: Setup Ruby 3.0
	- name: Setup Ruby 4.0.1

[Copilot]

Grammar: 'not support' should be 'does not support' (or 'did not support', depending on intent).

Suggested change

	- noop backend not support encrypted files #680 (https://github.com/jkroepke/helm-secrets/pull/680)
	- noop backend does not support encrypted files #680 (https://github.com/jkroepke/helm-secrets/pull/680)

[Copilot]

There are two consecutive actions/checkout steps using the same ref. If this isn't intentional (e.g., checking out two different repositories), consider removing the redundant checkout or configuring the first/second step to clearly target different repos/paths to reduce confusion.

[Copilot]

This assertion only checks for the presence of a substring, which can allow false positives (e.g., if some unrelated output includes the same token). Consider tightening the expectation to ensure the decrypted content is what you expect (for example, anchoring the pattern or asserting the full output/line content relevant to the fixture).