fix(ci): stop the release from publishing charts with no subcharts

.github/workflows/release-charts.yaml

@@ -53,13 +53,23 @@ jobs:
 
       - name: Add repositories for dependencies
         run: |
-          helm repo add valkey https://valkey.io/valkey-helm/
+          # Every non-OCI dependency repository must be here. dragonfly is OCI
+          # and needs no `repo add`; cert-manager is not, and without jetstack
+          # `helm dependency build` cannot resolve it at all.
+          helm repo add jetstack https://charts.jetstack.io
           helm repo update
 
       - name: Build chart dependencies
         run: |
-          for chart in charts/*; do
-            [ -f "$chart/Chart.yaml" ] && helm dependency build "$chart" || true
+          # No `|| true`. Swallowing this is how a release ships a chart with
+          # an EMPTY charts/ directory: dependency build fails, chart-releaser
+          # packages whatever is on disk, and the published chart renders none
+          # of its subcharts - silently, because a gated subchart that is
+          # simply absent looks exactly like one that is turned off.
+          set -euo pipefail
+          for chart in charts/*/; do
+            [ -f "$chart/Chart.yaml" ] || continue
+            helm dependency build "$chart"
           done
 
       - name: Run chart-releaser

.github/workflows/validate-charts.yaml

@@ -30,17 +30,21 @@ jobs:
 
       - name: Add repositories for dependencies
         run: |
-          helm repo add valkey https://valkey.io/valkey-helm/
+          # Keep in step with release-charts.yaml. dragonfly is OCI and needs
+          # no `repo add`; cert-manager needs jetstack.
+          helm repo add jetstack https://charts.jetstack.io
           helm repo update
 
-      # Only synapse-stack has a tracked Chart.lock. `build` happens to fall
-      # back to resolving when the lock is absent, but that is version-
-      # dependent behaviour, so fall back explicitly rather than rely on it.
+      # Strictly `build`, with no `update` fallback. The fallback used to
+      # regenerate a stale Chart.lock in place, so CI passed on a lock that a
+      # clean checkout - and the release job - could not build from. Reviewing
+      # a repaired tree tells you nothing about the tree you are shipping.
       - name: Build chart dependencies
         run: |
+          set -euo pipefail
           for chart in charts/*/; do
             [ -f "$chart/Chart.yaml" ] || continue
-            helm dependency build "$chart" || helm dependency update "$chart"
+            helm dependency build "$chart"
           done
 
       - name: helm lint

charts/synapse-stack/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: synapse
   repository: file://../synapse
-  version: 0.10.1
+  version: 0.10.2
 - name: synapse
   repository: file://../synapse
-  version: 0.10.1
-digest: sha256:ac214a2d21ccf8348b81aeee7abea4e3261c689c54930394b8ea186ef32169fc
-generated: "2026-09-18T15:24:14.08431236+02:00"
+  version: 0.10.2
+digest: sha256:b70e93b023771c29502c9075033c13e50231bd06568cd62eb574a1da789efe74
+generated: "2026-09-18T16:34:46.22438654+02:00"

charts/synapse-stack/Chart.yaml

@@ -3,8 +3,8 @@ name: synapse-stack
 description: Umbrella chart that installs the Synapse dataplane together with the Synapse operator
 # Release synapse-stack v0.1.5
 type: application
-# Bumped: refuse cert-manager on both aliases, and follow synapse to 0.10.1.
-version: 0.12.1
+# Bumped: follows synapse to 0.10.2 (regenerated Chart.lock).
+version: 0.12.2
 appVersion: "0.8.3"
 home: https://gen0sec.com
 icon: https://raw.githubusercontent.com/gen0sec/helm-charts/main/images/logo.png
@@ -24,12 +24,12 @@ dependencies:
   #   proxy  → synapse-proxy (TLS passthrough / L7 / Tier-2 terminate)
   #   agent  → synapse-agent (XDP transparent observe; edge only)
   - name: synapse
-    version: 0.10.1
+    version: 0.10.2
     repository: "file://../synapse"
     alias: proxy
     condition: proxy.enabled
   - name: synapse
-    version: 0.10.1
+    version: 0.10.2
     repository: "file://../synapse"
     alias: agent
     condition: agent.enabled

charts/synapse/Chart.lock

@@ -5,5 +5,5 @@ dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
   version: v1.21.2
-digest: sha256:c69675ad6ece0f9f158e06dfb961dddbd9978d53fdecbea3707cd9826b9a7d67
-generated: "2026-09-18T14:32:21.205837929+02:00"
+digest: sha256:ead8c693a6d8ab0916de913cc29342857ed6bc57e4635b1f157090c19ecd23b3
+generated: "2026-09-18T16:32:31.428981784+02:00"

charts/synapse/Chart.yaml

@@ -3,8 +3,10 @@ name: synapse
 description: A Helm chart for Synapse reverse proxy with security features
 type: application
 
-# Bumped: refuse cert-manager and synapse's built-in ACME at the same time.
-version: 0.10.1
+# Bumped: Chart.lock regenerated. The committed lock predated the
+# cert-manager condition rename, so `helm dependency build` failed on a clean
+# checkout and the release packaged this chart with no subcharts at all.
+version: 0.10.2
 appVersion: "0.8.3"
 
 dependencies: