[bmscomp]

Why

The chart publisher in #461 never pushes a version that is already in the registry, so a chart's published digest never changes. The cost is that a chart change merged without a new Chart.yaml version is never published, and nothing says so. This is PR B of the chart publishing plan.

Replayed over main's 44 chart-touching commits since 2026-09-15, the gate would have caught:

• 4 real misses: template or values changes merged without a bump in fix(chart): the kafka-exporter NetworkPolicy no longer collides with Strimzi 1.3's #456 (kafka-cluster's network policy), feat(deploy): harden deployment flow and runtime reliability #368 (kates, kafka-cluster, monitoring, strimzi-operator), ci: gates, pinned actions, lint workflow, supply-chain scans, one release run #157 (kafka-ui) and Rebuild the Grafana dashboards, and deliver them from one chart #149 (kafka-cluster, kafka-common, strimzi-operator).
• 31 commits that moved a subchart without bumping kates-platform. These include every release pin PR, chore(release): prepare v1.29.2 #459 among them. The umbrella vendors its subcharts as they are on disk, so each published umbrella would have kept the old ones.

What changes

scripts/chart_bumps.py checks every PR against its merge base:

1. A chart whose packaged files changed carries a new, higher version.
   • "Packaged" follows each chart's .helmignore, using helm package's rules. So tests/ and the values-*.yaml overlays need no bump.
   • Negated rules are refused rather than guessed.
   • A version that goes down fails.
2. A chart that packs a file:// subchart whose version moved carries a new version too.
   • In practice that is kates-platform.
   • The kafka-common consumers pin it exactly, so rule 1 already catches them.

A new chart needs no bump.

Deliberate choice: docs need no bump. README.md and docs/ are packaged, but nothing an install reads, so they ship with the chart's next version. Without this exemption, three README-only commits in the replay would have needed a bump. Easy to reverse if you'd rather hold docs to the same rule.

Where it runs

• A Chart versions job in CI · Lint, on PRs that touch charts/. It runs the unit tests first. It is on Gate · Lint, and skipped on pushes to main.
• make check runs the gate too.
• CONTRIBUTING's CI table names it.

What this means for releases: a release pin PR now bumps kates-platform along with the other pinned charts. The gate fails until it does.

Tests

• python3 -m unittest discover -s scripts -p 'test_chart_bumps.py': 16 tests. They cover helmignore matching (anchored, any-depth and directory rules, * not crossing /, negation refused) and version order. They also run both rules against a throwaway git repository with a chart and an umbrella.
• The gate on this branch: OK.
• The gate on this branch with one template edited and no bump: fails, naming the file.
• The gate with kates bumped alone: fails, naming kates-platform.
• The history replay described above, one run per commit against its parent.
• actionlint 1.7.12, yamllint, scripts/check-versions.sh --workflows, make check-help.

Independent of #461; either can merge first.