[bmscomp]

Why

v1.29.3 publishes the Helm charts through the release (#461), for the first time and from the release path, behind the chart version and dependency-checksum gates (#462, #463).

It carries no image change. v1.29.2 was re-pointed at #460's merge (0674b86), and its re-run (40076472779) went green end to end: images verified and signed, GitHub Release, tap. So kates:1.29.2 is clean and signed, and the charts on main already pin good images.

Decided: cut v1.29.3 rather than dispatch the chart workflow, so the first publish also tests the release wiring.

Main is merged in, with #462 and #463 (225fb1c), and the gates re-ran on the merged branch. The tag waits for your go-ahead once every check is green.

Merging: the branch carries a merge from main, so merge with an explicit message (gh api -X PUT …/pulls/464/merge with commit_title and commit_message) rather than the concatenated default.

What changes

Image and kates-tester pins move to 1.29.3, as in #459:

Chart	Version	Entry
kates	0.13.4 → 0.13.5	appVersion and image tags 1.29.3 (values.yaml, -native in values-native.yaml, README)
strimzi-operator	0.4.3 → 0.4.4	testImages.kubectl
kafka-cluster	1.0.15 → 1.0.16	testImages.kubectl, testImages.kafka
connect-cluster	2.1.13 → 2.1.14	testImages.kubectl
mirror-maker2	0.11.11 → 0.11.12	testImages.kubectl
kates-chaos	2.3.3 → 2.3.4	images.tester
kates-platform	0.8.3 → 0.8.4	new for this release: the umbrella packs kates, kafka-cluster, connect-cluster and mirror-maker2 as they are on disk. #462's gate fails a subchart version change that the umbrella doesn't follow

Also moved:

• kates/k8s/deployment.yaml;
• the 12 Litmus experiment pins under config/litmus/experiments/;
• docs/registry/kates.md (5 pins) and docs/registry/kates-tester.md;
• docs/kafka-cluster-runbook.md;
• Recipe 7's KATES_VERSION in docs/book/14-recipes.md;
• the README chart table and the book's version matrix.

Each chart gets a change entry, and each Strimzi chart and kates-chaos gets its # Patch: comment.

Nothing under tester/, kates/src, cli/ or the Dockerfiles moved since the re-pointed v1.29.2, so the images are rebuilt unchanged; the kates and kates-tester entries say so. The two v1.29.2 mentions left, in Dockerfile.connect and kates/Dockerfile.native, are #460's comments about the first run.

The pins were scripted, with an assert on the expected count of every edit. The file set matches #459's exactly, plus charts/kates-platform/Chart.yaml.

After the tag

The release run publishes the 14 charts once the three images are through.

• The new GHCR packages probably start private: set each to public in its package settings.
• Then, from a logged-out shell, each chart should pull and pass cosign verify and gh attestation verify (README → Helm charts).
• Still unverified until that run: that a chart signed from release.yml carries the publish-charts.yml@refs/tags/v1.29.3 identity, and GHCR's wording for a package that doesn't exist yet. If either differs, the chart job fails closed, and the GitHub Release waits for the fix.

Tests

• scripts/check-versions.sh: OK, including the kates-tester pins held to appVersion 1.29.3.
• After merging main (feat(ci): a changed chart must carry a new version #462, feat(ci): fetched chart dependencies must match pinned checksums #463): scripts/chart_bumps.py origin/main OK, and its unit tests pass. Every bumped chart carries a new version, and kates-platform follows its subcharts.
• feat(ci): fetched chart dependencies must match pinned checksums #463's dependency check on the merged branch: all four fetched archives match charts/dependencies.sha256.
• gen-chart-table.sh --check and gen-version-matrix.sh --check: OK.
• helm lint with Helm 3.17.0 on all seven bumped charts, dependencies built: 0 failures.
• yamllint over charts, config and .github; check-book-style.sh; check-chart-test-paths.sh; make check-help.
• No chart unit test pins a chart version or the release tag. helm-unittest isn't installed locally, so the suites run in CI.