From d334eca5d20eb5428a8370bcfad84050d8ef4791 Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Sat, 8 Aug 2026 12:57:24 -0700
Subject: [PATCH 1/2] chore(deps): opencost, reloader and trivy-operator to
 current
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mirrors eks-gitops 46f9f8e. These three are dual-pinned, so mirror-check fails
on either side moving alone.

  opencost        2.5.28 -> 2.5.29
  reloader        2.2.14 -> 2.2.15
  trivy-operator  0.34.0 -> 0.35.0

upstream.ref moves with them, from 614560a to 46f9f8e. That range also carries
the operator chart's 0.6.3 -> 0.6.4 repoint, which kx does not follow and does
not need to: it builds that chart from a sibling checkout, already declared as a
gitops-only divergence.

`mirror-check sync` re-pinned zero slices, which is the useful signal here — the
versions written by hand already matched what eks-gitops pins, so the two sides
agree by derivation rather than by assertion. Full check afterwards: 32 charts
match, 12 declared divergences, 2 CRD installers answered.

The render gate passes for all three slices, including the mount check the loki
migration added, and the provenance and Renovate-coverage gates both stay green
at 32 pins.
---
 stack/core/reloader/install.sh           | 2 +-
 stack/observability/opencost/install.sh  | 2 +-
 stack/security/trivy-operator/install.sh | 2 +-
 stack/upstream.json                      | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/stack/core/reloader/install.sh b/stack/core/reloader/install.sh
index 6d71132..d3cae73 100755
--- a/stack/core/reloader/install.sh
+++ b/stack/core/reloader/install.sh
@@ -8,6 +8,6 @@ helm repo update stakater >/dev/null
 
 helm upgrade --install reloader stakater/reloader \
   --namespace kube-system \
-  --version 2.2.14 \
+  --version 2.2.15 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/observability/opencost/install.sh b/stack/observability/opencost/install.sh
index 59d04a6..b77c277 100755
--- a/stack/observability/opencost/install.sh
+++ b/stack/observability/opencost/install.sh
@@ -10,6 +10,6 @@ kubectl create namespace monitoring --dry-run=client -o yaml | kubectl apply -f
 
 helm upgrade --install opencost opencost/opencost \
   --namespace monitoring \
-  --version 2.5.28 \
+  --version 2.5.29 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/security/trivy-operator/install.sh b/stack/security/trivy-operator/install.sh
index 1ca4731..7857479 100755
--- a/stack/security/trivy-operator/install.sh
+++ b/stack/security/trivy-operator/install.sh
@@ -10,6 +10,6 @@ kubectl create namespace trivy-system --dry-run=client -o yaml | kubectl apply -
 
 helm upgrade --install trivy-operator aqua/trivy-operator \
   --namespace trivy-system \
-  --version 0.34.0 \
+  --version 0.35.0 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/upstream.json b/stack/upstream.json
index 0a9c151..e915465 100644
--- a/stack/upstream.json
+++ b/stack/upstream.json
@@ -3,7 +3,7 @@
   "upstream": {
     "repository": "nanohype/eks-gitops",
     "path": "applicationsets",
-    "ref": "614560ad84ad0461506c4574f50f7e449a7b3c55"
+    "ref": "46f9f8e94d7d63a7092007f22dcf77a7de6fd9e5"
   },
   "divergences": [
     {

From 02fdd01f49ef9348b59563f389f41b4fa51ea4f9 Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Sat, 8 Aug 2026 12:58:00 -0700
Subject: [PATCH 2/2] chore: ignore __pycache__
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Running any gate script under scripts/ leaves a __pycache__ directory behind,
and this repo did not ignore it. eks-gitops, landing-zone and eks-agent-platform
all do.

An untracked directory is not cosmetic here. Several checks in this org read
`git status --porcelain` to decide whether a tree is clean before acting —
landing-zone's e2e refuses to start against a dirty tree, and `gh pr create`
warns on one — so running the repo's own verification makes the repo look
modified to the next thing that asks.

Surfaced by running the gates this branch's other commit reports on.
---
 .gitignore | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitignore b/.gitignore
index a46cc75..91527a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,8 @@
 
 # Local planning notes
 .plans/
+
+# Running the gate scripts under scripts/ leaves this behind. An untracked
+# directory is not harmless here: several checks in this org read
+# `git status --porcelain` to decide whether a tree is clean before acting.
+__pycache__/