probe: force IPv4 for the Helm download, then measure what was actually asked

Confirms the diagnosis and unblocks the measurement in one step. Not a
proposed fix - PR #253 is untouched. freesailarr is back in the matrix so
questions 1-3 can be answered: does k3s come up, how long does it take,
and does the hardest chart in the repo run with a real tunnel.

.github/workflows/validate-charts.yml

@@ -288,8 +288,41 @@ jobs:
     steps:
       - name: "Checkout Repository"
         uses: actions/checkout@v7
-      - name: "Install Helm"
+      - name: "PROBE egress from the job container (throwaway branch only)"
-        uses: azure/setup-helm@v5
+        run: |
+          set +e
+          echo "### resolv.conf"; cat /etc/resolv.conf
+          echo "### DNS"
+          for h in get.helm.sh api.github.com raw.githubusercontent.com registry-1.docker.io ghcr.io; do
+            printf '%-28s ' "$h"; getent hosts "$h" || echo "DNS FAILED"
+          done
+          echo "### HTTPS from the JOB container"
+          for u in https://get.helm.sh/helm-v3.18.4-linux-amd64.tar.gz https://api.github.com/ https://raw.githubusercontent.com/ https://registry-1.docker.io/v2/ https://ghcr.io/v2/; do
+            printf '%-62s ' "$u"
+            curl -sS -o /dev/null -m 20 -w 'http=%{http_code} dns=%{time_namelookup}s conn=%{time_connect}s total=%{time_total}s\n' "$u" || echo "CURL FAILED"
+          done
+          echo "### egress of the DOCKER DAEMON (separate network path)"
+          docker pull --quiet alpine:3.20 && echo "docker pull alpine OK" || echo "docker pull alpine FAILED"
+          docker pull --quiet ghcr.io/k3d-io/k3d-proxy:5.9.0 && echo "docker pull ghcr OK" || echo "docker pull ghcr FAILED"
+          echo "### cgroups (the thing that was fixed)"
+          docker info --format 'server={{.ServerVersion}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} storage={{.Driver}}'
+          docker info 2>&1 | grep -iE "rootless|WARNING" || echo "(no rootless/WARNING lines)"
+          echo "### done - this step never fails on purpose"
+          exit 0
+      # PROBE ONLY - this is NOT a proposed fix and is not in PR #253.
+      # azure/setup-helm downloads from get.helm.sh, which in this cluster
+      # resolves to an IPv6 Azure Front Door address (2603:1061:14:67::1) that
+      # never completes a TCP connect. curl -4 forces IPv4; if this succeeds it
+      # both unblocks the measurement and proves the diagnosis, because every
+      # other host in the probe resolved to IPv4 and answered in under a second.
+      - name: "Install Helm (PROBE: forced IPv4)"
+        run: |
+          curl -4 -sSfL -o /tmp/helm.tgz https://get.helm.sh/helm-v4.3.0-linux-amd64.tar.gz
+          tar -xzf /tmp/helm.tgz -C /tmp
+          mkdir -p "$HOME/.local/bin"
+          mv /tmp/linux-amd64/helm "$HOME/.local/bin/helm"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          "$HOME/.local/bin/helm" version
       # freesailarr is the one chart whose install-test needs credentials:
       # without a real Wireguard key gluetun never completes a handshake, and
       # behind its kill switch not a single app container becomes Ready. The key
@@ -332,10 +365,31 @@ jobs:
           : "${FREESAILARR_WG_KEY:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/credential}"
           : "${FREESAILARR_WG_ADDRESSES:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/ip-address}"
           echo "Both VPN values arrived non-empty."
+      - name: "PROBE runner facts (throwaway branch only)"
+        run: |
+          echo "runner=${RUNNER_NAME:-?} os=${RUNNER_OS:-?} arch=${RUNNER_ARCH:-?} nproc=$(nproc)"
+          free -m | head -2 || true
+          df -h / | tail -1 || true
+          docker info --format 'server={{.ServerVersion}} storage={{.Driver}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} rootless={{.SecurityOptions}} cpus={{.NCPU}} mem={{.MemTotal}}' || echo "docker info FAILED"
+          docker info 2>&1 | grep -iE "rootless|warning" || echo "(no rootless/warning lines)"
+          ls -l /dev/fuse 2>&1 || echo "(no /dev/fuse)"
       - name: "Install k3d"
         run: curl -sSfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG="$K3D_VERSION" bash
       - name: "Create k3d cluster"
-        run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s
+        run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s --no-rollback
+      - name: "PROBE k3s did not come up (throwaway branch only)"
+        if: failure()
+        run: |
+          docker ps -a
+          echo "=== k3s node log ==="
+          docker logs k3d-install-test-server-0 2>&1 | tail -120 || true
+          echo "=== docker info ==="
+          docker info || true
+      - name: "PROBE cluster is usable (throwaway branch only)"
+        run: |
+          kubectl get nodes -o wide
+          kubectl get --raw='/readyz?verbose' | tail -5
+          kubectl -n kube-system get pods
       # Every chart reaching this step is one the exclusion filter let through,
       # so the script's SKIP branch is never taken here - it exists for local
       # runs. The variables below are empty for every chart but the one that

cyberchef/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/gchq/CyberChef/master/src/web/static/ima
 
 type: application
 
-version: 9.0.1+up11.4.0
+version: 9.0.2+up11.4.0
 appVersion: "11.4.0"
 
 maintainers:

freesailarr/Chart.yaml

@@ -8,7 +8,7 @@ description: A Helm chart to deploy a Wireguard-tunneled media automation stack
 
 type: application
 
-version: 3.0.5+up1.0.0
+version: 3.0.6+up1.0.0
 # The chart's own version marker, freely chosen and tied to no upstream. The
 # stack bundles nine independently versioned projects, so there is no single
 # "app version" to track here.