ci: guard — chart content change requires a Chart.yaml version bump

[LukasWodka]

Prevents the gap Divya's staging test surfaced: PR #472 changed client/templates/jobs-manager-deployment.yaml (the perIngestionTables env block) without bumping Chart.yaml, so the published 1.9.7 package stayed stale and the flag never rendered on installs — even though the source was correct and the helm-unittest passed (it renders the source, not the published artifact).

This blocking gate: any PR touching client/templates/** or client/values.yaml must also bump client/Chart.yaml's version: line, else it fails. Non-chart PRs are unaffected (guard short-circuits to N/A).

After merge, add it to develop/staging/main required status checks (admin) so it actually blocks.

Sibling guard for the ingestor image (which had the analogous gap — #408 merged without a __version__ bump, so no image was released): tracebloc/data-ingestors (next PR).

Epic: tracebloc/backend#1151

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only guard with read-only repo permissions; no runtime or deployment behavior changes until the check is added to required status checks.

Overview
Adds a blocking PR workflow so Helm chart edits cannot merge without a publishable version bump.

On every pull request, if the diff touches client/templates/** or client/values.yaml, the job requires client/Chart.yaml to include a new +version: line; otherwise it fails with an actionable error. PRs that only change non-chart paths exit successfully with “guard N/A.”

This closes the gap where template/values fixes could pass tests and land in git but never ship to installs because the chart repo only publishes when version changes.

^{Reviewed by Cursor Bugbot for commit efa2b25. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 37 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (Prod: Set kubeconfig context namespace after Helm install for tracebloc  #209) · author: @divyasinghds · no reviewer assigned
• averaging-service#225 — fix(averaging): fail fast + dead-letter on permission-denied weight write (release: promote develop → main (installer hardening — OOM gate, apt/needrestart fixes, drift CI) #221) · author: @divyasinghds · no reviewer assigned
• averaging-service#245 — chore(ci): record gitleaks history baseline (triaged false positives) · author: @LukasWodka · no reviewer assigned
• averaging-service#246 — feat(chart): ServiceAccount + IRSA + blobStore env for the S3 backend (#1162) · author: @saadqbal · reviewer: @aptracebloc
• averaging-service#247 — fix(averaging): classify S3 access-denied weight writes as permanent (fix(mysql): probe over TCP so a moved socket can't kill a healthy DB #225 follow-up) · author: @divyasinghds · reviewer: @saadqbal
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

/fr-pass