feat: follow the loki and tempo charts to their new home, and notice next time

.github/workflows/chart-provenance.yml

@@ -0,0 +1,50 @@
+name: chart provenance
+
+# The live half of the chart-provenance check: is every chart this catalog pins
+# still the chart it was pinned for, upstream, right now?
+#
+# It is a separate workflow rather than a job in ci.yml on purpose, and there
+# are two reasons.
+#
+# The verdict is not a function of this commit. A maintainer can deprecate a
+# chart, or hand it to a different organisation, at any moment. Run in the merge
+# path, that turns a pull request red for a reason the pull request did not
+# cause — the same trap `mirror-check freshness` and `schemas:freshness` are
+# kept off the blocking path to avoid.
+#
+# And the merge gate in ci.yml refuses any workflow containing a job it does not
+# watch, while counting a skipped dependency as a failure. A job that only runs
+# on a schedule cannot satisfy both, so it does not belong in that file. The
+# offline half — every pin has a record, every record a pin — does run there,
+# because that IS a function of the tree.
+on:
+  schedule:
+    # Mondays, ahead of the working week and after the weekend's upstream releases.
+    - cron: "0 13 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  live:
+    name: pinned charts still are what they were
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Install Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
+
+      - name: Install PyYAML
+        run: pip install --quiet pyyaml
+
+      # Fails on a `deprecated: true`, and on a chart whose description no
+      # longer matches what was recorded. The second is the one worth having:
+      # a chart can be re-scoped to a different product, or forked away to a
+      # different maintainer, without anyone ever setting the deprecated flag,
+      # and then the pin keeps resolving and the currency signal keeps saying
+      # "current" for something that is no longer the same software.
+      - name: Compare every pinned chart against its record
+        run: ./scripts/check-chart-deprecation.py --live

.github/workflows/ci.yml

@@ -335,6 +335,16 @@ jobs:
       - name: Sync-wave ordering gate
         run: ./scripts/check-sync-waves.py
 
+      # Offline half of the chart-provenance gate: every pinned chart has a
+      # record and every record a pin. Deliberately does not touch the network —
+      # whether a chart went deprecated overnight is not a function of this
+      # commit, and gating merges on it would redden pull requests that changed
+      # nothing. chart-provenance.yml asks that question on a schedule.
+      - name: Chart provenance gate
+        run: |
+          ./scripts/check-chart-deprecation.py
+          ./scripts/check-chart-deprecation.py --self-test
+
   # ── Appset render gate ───────────────────────────────────────────────
   # The Karpenter EC2NodeClass patch carries if/range control flow inside a
   # `patch: |-` string block. Every other gate treats that string as opaque —

applicationsets/addons-loki.yaml

@@ -38,9 +38,15 @@ spec:
     spec:
       project: platform
       sources:
-        - repoURL: https://grafana.github.io/helm-charts
+        # The OSS Loki chart moved to grafana-community, forked at 6.55.0. The
+        # chart still published at grafana/helm-charts is now maintained for
+        # Grafana Enterprise Logs only — its description says so and its 7.x
+        # line is the GEL line, but it carries no `deprecated` flag, so nothing
+        # would ever have reported that the pin had changed product underneath
+        # it. This is the OSS lineage, continuous from the fork point.
+        - repoURL: https://grafana-community.github.io/helm-charts
           chart: loki
-          targetRevision: 7.2.0
+          targetRevision: 18.7.5
           helm:
             releaseName: loki
             # S3 log storage, injected only on clusters carrying the observability/loki-bucket

applicationsets/addons-tempo.yaml

@@ -35,9 +35,15 @@ spec:
     spec:
       project: platform
       sources:
-        - repoURL: https://grafana.github.io/helm-charts
+        # grafana/helm-charts deprecated this chart and handed it to
+        # grafana-community, which carries the full history rather than
+        # restarting: same chart, same single-binary topology, renumbered at the
+        # fork (1.24.4 -> 2.x). Grafana's own published chart names this as the
+        # destination. tempo-distributed is NOT the successor — it was deprecated
+        # in the same move and lives in the community repo too.
+        - repoURL: https://grafana-community.github.io/helm-charts
           chart: tempo
-          targetRevision: 1.24.4
+          targetRevision: 2.2.3
           helm:
             releaseName: tempo
             # S3 trace storage, injected only on clusters carrying the observability/tempo-bucket

scripts/chart-provenance.json

@@ -0,0 +1,155 @@
+{
+  "_README": "What each pinned chart says it is, recorded so that a change is visible. check-chart-deprecation.py compares upstream against this on a schedule; the blocking gate only checks that every pin has a record and every record a pin. A description change means the chart redescribed itself \u2014 read the upstream notes before running --sync, because that is the signal a chart has changed product or maintainer without ever setting a deprecated flag.",
+  "charts": {
+    "ai-gateway-crds-helm": {
+      "repo": "oci://docker.io/envoyproxy/ai-gateway-crds-helm",
+      "description": "The Helm chart for Envoy AI Gateway CRD",
+      "deprecated": false
+    },
+    "ai-gateway-helm": {
+      "repo": "oci://docker.io/envoyproxy/ai-gateway-helm",
+      "description": "The Helm chart for Envoy AI Gateway",
+      "deprecated": false
+    },
+    "argo-events": {
+      "repo": "https://argoproj.github.io/argo-helm",
+      "description": "A Helm chart for Argo Events, the event-driven workflow automation framework",
+      "deprecated": false
+    },
+    "argo-rollouts": {
+      "repo": "https://argoproj.github.io/argo-helm",
+      "description": "A Helm chart for Argo Rollouts",
+      "deprecated": false
+    },
+    "argo-workflows": {
+      "repo": "https://argoproj.github.io/argo-helm",
+      "description": "A Helm chart for Argo Workflows",
+      "deprecated": false
+    },
+    "aws-load-balancer-controller": {
+      "repo": "https://aws.github.io/eks-charts",
+      "description": "AWS Load Balancer Controller Helm chart for Kubernetes",
+      "deprecated": false
+    },
+    "cert-manager": {
+      "repo": "https://charts.jetstack.io",
+      "description": "A Helm chart for cert-manager",
+      "deprecated": false
+    },
+    "cilium": {
+      "repo": "https://helm.cilium.io",
+      "description": "eBPF-based Networking, Security, and Observability",
+      "deprecated": false
+    },
+    "descheduler": {
+      "repo": "https://kubernetes-sigs.github.io/descheduler/",
+      "description": "Descheduler for Kubernetes is used to rebalance clusters by evicting pods that can potentially be scheduled on better nodes. In the current implementation, descheduler does not schedule replacement of evicted pods but relies on the default scheduler for that.",
+      "deprecated": false
+    },
+    "external-dns": {
+      "repo": "https://kubernetes-sigs.github.io/external-dns/",
+      "description": "ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.",
+      "deprecated": false
+    },
+    "external-secrets": {
+      "repo": "https://charts.external-secrets.io",
+      "description": "External secrets management for Kubernetes",
+      "deprecated": false
+    },
+    "falco": {
+      "repo": "https://falcosecurity.github.io/charts",
+      "description": "Falco",
+      "deprecated": false
+    },
+    "gateway-helm": {
+      "repo": "oci://docker.io/envoyproxy/gateway-helm",
+      "description": "The Helm chart for Envoy Gateway",
+      "deprecated": false
+    },
+    "goldilocks": {
+      "repo": "https://charts.fairwinds.com/stable",
+      "description": "A Helm chart for running Fairwinds Goldilocks. See https://github.com/FairwindsOps/goldilocks",
+      "deprecated": false
+    },
+    "grafana-operator": {
+      "repo": "https://grafana.github.io/helm-charts",
+      "description": "Helm chart for the Grafana Operator",
+      "deprecated": false
+    },
+    "karpenter": {
+      "repo": "oci://public.ecr.aws/karpenter/karpenter",
+      "description": "A Helm chart for Karpenter, an open-source node provisioning project built for Kubernetes.",
+      "deprecated": false
+    },
+    "keda": {
+      "repo": "https://kedacore.github.io/charts",
+      "description": "Event-based autoscaler for workloads on Kubernetes",
+      "deprecated": false
+    },
+    "kube-state-metrics": {
+      "repo": "https://prometheus-community.github.io/helm-charts",
+      "description": "Install kube-state-metrics to generate and expose cluster-level metrics",
+      "deprecated": false
+    },
+    "kyverno": {
+      "repo": "https://kyverno.github.io/kyverno",
+      "description": "Kubernetes Native Policy Management",
+      "deprecated": false
+    },
+    "loki": {
+      "repo": "https://grafana-community.github.io/helm-charts",
+      "description": "Helm chart for Grafana Loki supporting monolithic, simple scalable, and microservices modes.",
+      "deprecated": false
+    },
+    "metrics-server": {
+      "repo": "https://kubernetes-sigs.github.io/metrics-server/",
+      "description": "Metrics Server is a scalable, efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines.",
+      "deprecated": false
+    },
+    "opencost": {
+      "repo": "https://opencost.github.io/opencost-helm-chart",
+      "description": "OpenCost and OpenCost UI",
+      "deprecated": false
+    },
+    "opentelemetry-collector": {
+      "repo": "https://open-telemetry.github.io/opentelemetry-helm-charts",
+      "description": "OpenTelemetry Collector Helm chart for Kubernetes",
+      "deprecated": false
+    },
+    "operator": {
+      "repo": "oci://ghcr.io/nanohype/eks-agent-platform/charts/operator",
+      "description": "eks-agent-platform \u2014 Kubernetes operator (CRDs + Deployment + RBAC).",
+      "deprecated": false
+    },
+    "prometheus-operator-crds": {
+      "repo": "https://prometheus-community.github.io/helm-charts",
+      "description": "A Helm chart that collects custom resource definitions (CRDs) from the Prometheus Operator, allowing for seamless integration with GitOps tools",
+      "deprecated": false
+    },
+    "reloader": {
+      "repo": "https://stakater.github.io/stakater-charts",
+      "description": "Reloader chart that runs on kubernetes",
+      "deprecated": false
+    },
+    "tempo": {
+      "repo": "https://grafana-community.github.io/helm-charts",
+      "description": "Grafana Tempo Single Binary Mode",
+      "deprecated": false
+    },
+    "trivy-operator": {
+      "repo": "https://aquasecurity.github.io/helm-charts",
+      "description": "Keeps security report resources updated",
+      "deprecated": false
+    },
+    "velero": {
+      "repo": "https://vmware-tanzu.github.io/helm-charts",
+      "description": "A Helm chart for velero",
+      "deprecated": false
+    },
+    "vpa": {
+      "repo": "https://charts.fairwinds.com/stable",
+      "description": "A Helm chart for Kubernetes Vertical Pod Autoscaler",
+      "deprecated": false
+    }
+  }
+}