[bmscomp]

Why

Four charts vendor a chart fetched from outside this repository:

Chart	Vendors	From
kafka-cluster	seaweedfs 3.68.0	seaweedfs.github.io (HTTP index)
kates-chaos	litmus-core 3.28.1	litmuschaos.github.io (HTTP index)
monitoring	kube-prometheus-stack 82.4.3	prometheus-community.github.io (HTTP index)
strimzi-operator	strimzi-kafka-operator 1.2.0	quay.io (OCI)

No Chart.lock is committed, and nothing checked the bytes. helm dependency build packed whatever those repositories served under the pinned version, and once #461 lands, the publish job signs it. A compromised or re-published upstream archive would ship under our signature. This is PR C of the chart publishing plan.

What changes

• charts/dependencies.sha256 pins the four archives, in sha256sum format.
• The helm-deps action checks every chart it builds. The same action is used by ci.yml and the publish job:
  • an archive that differs from its pin fails;
  • a pinned archive that is missing fails, so a dependency can't move to a new version without its pin;
  • an archive with no pin fails, so a new dependency can't arrive unpinned.
• Subcharts packed from charts/ (file://) are rebuilt on every run and aren't pinned.
• The error names the file and the line to add. It also says to check a new archive against its repository's index digest first.

Where the hashes come from: each one matches the digest upstream publishes today. For the three HTTP charts that is the digest in the repository's index.yaml. For Strimzi it is the chart-content layer of quay.io's strimzi-kafka-operator:1.2.0 manifest.

For future bumps: bumping one of these dependencies, including the Strimzi operator chart, now needs its line in charts/dependencies.sha256 updated too. Dependabot doesn't manage Helm dependencies here, so no bot PR will hit this unawares.

Tests

• The four archives fetched with Helm 3.17.0 (CI's pin), hashed, and compared with the upstream records above.
• The check, extracted from the action and run on those archives:

Case	Result
All seven charts built, clean	pass, 4 archives OK
One byte appended to the seaweedfs archive	fail: FAILED, then the mismatch error
seaweedfs at a new version, pin unchanged	fail: not pinned
Pinned archive missing	fail
An unpinned archive added to a chart	fail: not pinned
ci.yml's subset (no strimzi-operator)	pass, 3 archives OK

• kates-platform's own subcharts (kafka-cluster, kates, …) are correctly left unpinned.
• shellcheck on the action's script, actionlint, yamllint, scripts/check-versions.sh, gen-chart-table.sh --check.
• sha256sum -c - works with both GNU coreutils (CI) and macOS.

Independent of #461 and #462.