chart: bump default image tags 2.1.1 → 2.2.0 (chart 2.2.0 catch-up)

[me-bender]

Summary

Chart 2.2.0 (from #39 — multi-App GitHub auth) shipped with values.yaml image tags still pinned to 2.1.1. This PR fixes the defaults so a fresh helm install of chart 2.2.0 actually picks up the matching lunar-* images.

Why this didn't happen automatically

The auto-bump in .github/workflows/bump-and-release.yml was dispatched by lunar's release.yml when lunar-hub-v2.2.0 was tagged. The workflow ran but failed at the git push origin main step:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.

Branch ruleset 9498811 requires PRs (1 approving review, squash-only). Direct push from github-actions[bot] is rejected.

Failed run: https://github.com/earthly/charts/actions/runs/26525092907

What this PR does

• charts/lunar/values.yaml: hub.image.tag, operator.image.tag, operator.initImage.tag, operator.sidecarImage.tag, grafana.image.tag all bumped from 2.1.1 → 2.2.0.
• Chart.yaml stays at 2.2.0 — this is a values-only correction. Cutting chart 2.2.1 here would decouple chart version from hub version, which the auto-bump assumes.

Follow-ups (separate PRs)

1. Patch bump-and-release.yml to open a PR (push to a branch + gh pr create --auto-merge) instead of pushing to main. That way the next hub release auto-bumps cleanly.
2. Cut lunar-hub-v2.2.1 for the Grafana dashboard fixes (#1710) + snippet_runs index (#1708) currently sitting on main post-tag.

Test plan

• Diff is 5 line changes, no whitespace noise (used Edit not yq -i).
• Auto-merge enabled — squash-merge once approved.
• After merge, release.yml runs chart-releaser. Chart.yaml is unchanged (still 2.2.0), so no new chart artifact is published; the helm repo's existing 2.2.0 stays as-is. The fix lands when chart 2.2.1 is cut by the next hub release.

[lunar-internal]

🌒 Earthly Lunar

❌ 2 Failing

• ❌ changelog-exists changelog.changelog-exists - Verifies that a CHANGELOG file exists in the repository root. Detects
  common variants (CHANGELOG.md, CHANGELOG, CHANGES.md, HISTORY.md,
  RELEASES.md). Intended for repos that ship versioned releases — apply
  via lunar-config on: targeting (e.g. public-only) rather than blanketly.
  Reads from .repo.changelog.

  • No CHANGELOG file found. Add a CHANGELOG.md to record notable changes per release (see https://keepachangelog.com/).

• ❌ instruction-file-exists ai.instruction-file-exists - Verifies that an agent instruction file exists at the repository root. Checks
  ai.instructions.all[] which is populated by the ai collector (AGENTS.md) and
  tool-specific collectors via array append (CLAUDE.md, CODEX.md, GEMINI.md).
  Passes if any entry exists.

  • No agent instruction file found at repository root (e.g. AGENTS.md, CLAUDE.md, GEMINI.md)

More Details

✅ 11 Passing

• ✅ branch-protection-enabled vcs.branch-protection-enabled - Requires branch protection rules to be enabled on the default branch.
  Branch protection is the foundation for all other VCS security controls.

• ✅ build-tagged container.build-tagged - Requires container builds to use an explicit image tag via -t/--tag.
  Untagged builds produce anonymous images that cannot be tracked or deployed.

• ✅ codeowners-catchall repo-hygiene.codeowners-catchall - Requires a default catch-all rule (*) in CODEOWNERS so that every file
  in the repository has at least one owner.

8 more...

• ✅ codeowners-exists repo-hygiene.codeowners-exists - Requires a CODEOWNERS file to be present in the repository.
  Checks standard locations: root, .github/, or docs/.

• ✅ codeowners-valid repo-hygiene.codeowners-valid - Validates that the CODEOWNERS file has correct syntax.
  Checks that all owner references use valid formats (@user, @org/team, or email).

• ✅ disallow-force-push vcs.disallow-force-push - Prohibits force pushes to protected branches to preserve commit history.
  Force pushes can destroy audit trails and cause data loss.

• ✅ no-latest container.no-latest - Prevents use of the :latest tag (explicit or implicit) in base images.
  Using :latest creates non-reproducible builds and makes debugging difficult.

• ✅ readme-exists repo-hygiene.readme-exists - Verifies that a README file exists in the repository root.
  Every repository should have basic documentation for discoverability.

• ✅ require-default-branch vcs.require-default-branch - Validates the default branch name matches the required name (default "main").
  Helps standardize branch naming across repositories.

• ✅ require-pull-request vcs.require-pull-request - Requires all changes to go through pull requests before merging.
  Prevents direct pushes to protected branches without review.

• ✅ stable-tags container.stable-tags - Requires base images to use stable tags: digests (sha256:...) or full semver (1.2.3).
  Partial versions like "node:20" can change unexpectedly and break builds.

More Details

[me-bender]

Lunar bot flagged 2 failing checks on this PR — both are repo-level pre-existing, not introduced by this catch-up.

Check	Cause	Fix
changelog-exists	No CHANGELOG.md at repo root (chart-level exists at charts/lunar/CHANGELOG.md, but the policy reads .repo.changelog)	#48 (just opened)
instruction-file-exists	No AGENTS.md / CLAUDE.md at repo root	#46 (draft, awaiting flip to ready)

Neither failure blocks merging this PR — the branch ruleset doesn't require lunar checks. This PR can squash-merge on approval as planned; the two hygiene fixes will land separately and clear the failures for every future PR.

[brandonSc]

its possible Fry doesn't see it when its put in open mode instead of draft first we can track that down separately (fix in Fry's code)