Another chart fix

[michaeljguarino]

bump

Test Plan

Checklist

• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have added a meaningful title and summary to convey the impact of this PR to a user.

Plural Flow: console

[greptile-apps]

Greptile Summary

This PR is a follow-up to #3394 ("Add plural chart to main repo"), adding the ory and plural Helm repo entries to the chart publish workflow so that helm/chart-releaser-action can resolve the plural chart's dependencies (hydra from ory, test-base from plural module-library), along with a version bump of charts/plural/Chart.yaml to 0.10.108.

Confidence Score: 5/5

Safe to merge — the functional fix (adding missing Helm repos) is correct and the only remaining finding is a P2 security hygiene suggestion.

All changes are narrowly scoped: adding two Helm repo entries to unblock chart publishing and bumping the chart version. The sole finding (mutable @master action pin) is a pre-existing P2 hygiene issue, not introduced by this PR.

No files require special attention.

Vulnerabilities

• .github/workflows/chart.yaml line 45: uses: mikefarah/yq@master pins to a mutable branch, creating a supply-chain risk if the upstream repo is compromised or force-pushed. Should be pinned to a specific version tag or commit SHA.

Important Files Changed

Filename	Overview
.github/workflows/chart.yaml	Adds ory and plural helm repos required for the new plural chart's dependencies (hydra, test-base); minor security concern with mikefarah/yq@master pinning.
charts/plural/Chart.yaml	Version bump to 0.10.108; chart metadata and dependencies look correct and align with the repos added in the workflow.

Comments Outside Diff (1)

1. .github/workflows/chart.yaml, line 45 (link)

   Mutable @master reference for mikefarah/yq

   Pinning a GitHub Action to @master means any push to that branch silently changes the code executed in CI. If the upstream repo is compromised or accidentally broken, it will affect this workflow immediately. Pin to a specific released version tag or commit SHA instead.

_{Reviews (1): Last reviewed commit: "Another chart fix" | Re-trigger Greptile}