Upgrade stormforge-agent pack to 2.28.5

[edwin-villa]

Upgrade stormforge-agent pack to 2.28.5

[bulwark-sc-ent]

✅ CVE scan completed successfully.

Scan Summary:

• Total images scanned: 2
• Clean images: 0
• Images with CVEs: 2
• Total CVEs found: 9

🔴 Critical CVEs: 0
🟠 High CVEs: 1
🟡 Medium CVEs: 2
🟢 Low CVEs: 6

Images with CVEs:

• quay.io/prometheus/prometheus:v3.13.1: 8 CVEs (Critical: 0, High: 1, Medium: 2, Low: 5)
• registry.stormforge.io/optimize/workload-agent:2.28.5: 1 CVEs (Critical: 0, High: 0, Medium: 0, Low: 1)

⚠️ Please review the CVE findings above and address critical/high severity issues before merging.

[bulwark-sc-ent]

✅ CVE scan completed successfully.

Scan Summary:

• Total images scanned: 2
• Clean images: 0
• Images with CVEs: 2
• Total CVEs found: 9

🔴 Critical CVEs: 0
🟠 High CVEs: 1
🟡 Medium CVEs: 2
🟢 Low CVEs: 6

Images with CVEs:

• quay.io/prometheus/prometheus:v3.13.1: 8 CVEs (Critical: 0, High: 1, Medium: 2, Low: 5)
• registry.stormforge.io/optimize/workload-agent:2.28.5: 1 CVEs (Critical: 0, High: 0, Medium: 0, Low: 1)

⚠️ Please review the CVE findings above and address critical/high severity issues before merging.

[vishwanaths]

Pack review — stormforge-agent-2.28.5

Packs Validation: ❌ FAILURE (run https://github.com/spectrocloud/pack-central/actions/runs/31047132402) — see Blockers below
source annotation: ❌ missing — pack.json has "annotations": {} (empty object; no source key)
Pack metadata: name=stormforge-agent version=2.28.5 addonType=monitoring layer=addon displayName=StormForge Agent contributor=(not set)

Compared against previous version

New pack — no prior stormforge-agent-* version exists on main. (There is a separately-named stormforge-optimize-live-0.7.8 pack, but not this one.) Skipping diff section.

Summary of contents

• pack.json: declares 1 chart (charts/stormforge-agent-2.28.5.tgz), empty kubeManifests, one optional kubernetes dependency (minVersion: 1.29), cloudTypes ["all"], empty eol and group.
• values.yaml (179 lines): sets pack.namespace: stormforge-system, declares two pack.content.images (registry.stormforge.io/optimize/workload-agent:2.28.5, quay.io/prometheus/prometheus:v3.13.1), and a full charts.stormforge-agent.* block (auth issuer/client id/secret, workload controller, prom forwarder, cluster-defaults exempt namespaces).
• schema.yaml: marks clusterName, authorization.clientID, authorization.clientSecret as required (clientSecret formatted as ${password}).
• charts/stormforge-agent-2.28.5.tgz: 29,349 bytes (~28.7 KiB). Contents not inspected.
• charts/stormforge-agent/ (unpacked chart tree, ~24 files including CRDs, templates, values.schema.json, README, ci/) is also committed alongside the tgz.
• logo.png: 780 bytes.
• README.md: 125 lines.

Blockers

• Packs Validation: workflow failed in the tool-install step (crane extraction) with gzip: stdin: not in gzip format / tar: Child returned status 1 before validate-packs.sh executed — no per-check ERROR: lines were emitted because validation never ran. This looks like an infrastructure flake in the google/go-containerregistry download (see step "Run sudo apt-get update ... curl ... crane" in the run log). Please push an empty commit or re-run the failed job so the validator actually executes. Review below is based on static inspection only; the validator has not vetted this pack yet.
• pack.json annotations.source is missing. Per the community-pack contract this must be set to "community". Add:

  "annotations": {
    "source": "community"
  }

  (Recommend also adding "contributor": "stormforge" or similar for attribution.)

Nits / observations

• Both the packed chart (charts/stormforge-agent-2.28.5.tgz) and the unpacked chart tree (charts/stormforge-agent/**) are committed. Convention across pack-central is to ship only the .tgz; committing both roughly doubles the pack size and creates a risk of them drifting. Consider removing charts/stormforge-agent/ from the PR.
• pack.json sets "eol": "" and "group": "" — fine, but if StormForge has an announced EOL for 2.28.x it would be worth filling in eol.
• Chart.yaml kubeVersion: '>= 1.16.x-0' is much older than the pack's declared dependency kubernetes minVersion: 1.29. Not blocking (the pack constraint is what Palette uses) but worth aligning.
• The security-scans/syft-license check is also failing on this PR — not part of pack-reviewer's scope, but flagging so the maintainer sees it.
• No README.md issues spotted; 125 lines with usage guidance.

Review generated by the pack-reviewer Claude Code subagent.