fix(container): update image ghcr.io/home-operations/charts/kopiur (0.7.4 → 0.7.5)

[smurf-bot]

This PR contains the following updates:

Package	Update	Change
ghcr.io/home-operations/charts/kopiur	patch	0.7.4 → 0.7.5

---

Release Notes

home-operations/kopiur (ghcr.io/home-operations/charts/kopiur)

v0.7.5

Compare Source

Bug Fixes

• readme: update readme admonition (987957c)
• secctx: SecurityContextCompatible is verified, not asserted; inherit merges with explicit (#​259) (cbfd97d)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[smurf-bot]

konflate — summary

Note

+0 added · 9 changed · −0 removed — 9 resources · 2 apps · 6 CRDs

Blast radius

• Kustomization storage/kopiur — 2 dependents (Kustomization storage/kopiur-repository +1 more)

Image changes

image	from	to
ghcr.io/home-operations/kopiur-controller	sha256:4dc4caf26f08…	sha256:c6916c716097…
ghcr.io/home-operations/kopiur-mover	sha256:8a2a396c37f2…	sha256:14ac29577e59…
ghcr.io/home-operations/kopiur-webhook	sha256:e9f70f8a7328…	sha256:297c79389bee…

View the full rendered diff →

_{konflate · rendered d12aee1 · advisory, not a gate}

[its-saffron]

AI Automated Review

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation: Approve

PR PR 8374 bumps the kopiur Helm chart from 0.7.4 → 0.7.5 via Renovate. Single file changed (kubernetes/apps/base/storage/kopiur/app/ocirepository.yaml), no risk flags, no breaking changes.

Change Summary

File	Change
kubernetes/apps/base/storage/kopiur/app/ocirepository.yaml	tag: 0.7.4 → tag: 0.7.5

Upstream Changes (from GitHub compare)

The 0.7.5 release contains three commits:

1. fix(secctx): SecurityContextCompatible is verified, not asserted; inherit merges with explicit — The core fix changes how inheritSecurityContextFrom combines with explicit securityContext/podSecurityContext: they now merge field-wise (explicit wins) instead of being mutually exclusive. The konflate rendered diff shows CRD description improvements documenting the merge behavior. This is a correctness fix — the previous behavior could silently drop explicit settings.
2. fix(readme): update readme admonition — README cleanup, removing outdated "brand new" warnings.
3. chore(main): release 0.7.5 — Release metadata.

Standards Compliance

• HelmRelease: Uses spec.chartRef pointing to a per-app OCIRepository (named kopiur), listed in kustomization.yaml. spec.interval: 15m is set. ✅
• Namespace convention: metadata.namespace intentionally omitted on HelmRelease (per documented convention). ✅
• OCI artifact pinning: OCI chart pinned by tag (0.7.5), not SHA digest — per documented convention. ✅
• Secrets policy: No new secrets introduced. ✅
• Registry allowlist: ghcr.io/home-operations/charts/kopiur — trusted internal chart. ✅

HelmRelease Values Compatibility

The upgrade-impact evidence confirms that none of the 3 changed chart defaults (inheritSecurityContextFrom description, podSecurityContext description, securityContext description/merge behavior) intersect with the values this repo sets in its HelmRelease. The local configuration is unaffected:

spec:
  values:
    features:
      credentialProjection:
        enabled: true
    installScope: cluster
    monitoring:
      dashboards:
        enabled: false
      prometheusRule:
        enabled: false
      serviceMonitor:
        enabled: false
    resources:
      requests:
        cpu: 50m
        memory: 128Mi

Evidence Provider Findings

• konflate: Rendered diff shows 9 changed resources (1 CRD, 2 Deployments with new image SHAs, 1 OCIRepository). No data-loss or immutable-field cautions. ✅
• upgrade-impact: Confirmed no default value drift intersects local HelmRelease values. ✅
• CI: All checks passed (Image Pull, Konflate, AI PR Review). ✅

Security Note

The secctx fix is an improvement in correctness: inheriting and explicit security contexts now merge field-wise rather than conflicting. Since this repo's HelmRelease does not use inheritSecurityContextFrom, this change is non-impactful for this deployment but improves safety for users who do.

---

Approve and merge. This is a safe patch-level bug-fix upgrade with no breaking changes and no impact on the local HelmRelease configuration.