feat(deployment)!: move image to deployment.gitea.image

The `image` values only ever configured the Gitea container itself — registry, repository, tag, digest,
pull policy and the rootless variant are all consumed by the `gitea` container and its init containers.
Keeping them at the top level suggested a chart-wide scope that never existed and separated them from the
other container-scoped settings that already live under `deployment.gitea` (`env`, `resources`).
Moving the block makes the container configuration self-contained and continues the consolidation of all
pod- and Deployment-scoped values under the `deployment` dict.

`imagePullSecrets` intentionally stays top-level, because it is a pod-level setting that also applies to
`extraContainers` and is paired with `global.imagePullSecrets`.

BREAKING CHANGE: `image` no longer exists. Use `deployment.gitea.image` instead. Values still set under
`image` are silently ignored, which would drop a pinned `tag` or `digest` and roll out the chart default
(`appVersion`) instead — review your values before upgrading.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/deployment/image-configuration.yaml

@@ -23,7 +23,7 @@ tests:
   - it: tag override
     template: templates/gitea/deployment.yaml
     set:
-      image.tag: "1.19.4"
+      deployment.gitea.image.tag: "1.19.4"
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
@@ -31,7 +31,7 @@ tests:
   - it: root-based image
     template: templates/gitea/deployment.yaml
     set:
-      image.rootless: false
+      deployment.gitea.image.rootless: false
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
@@ -39,7 +39,7 @@ tests:
   - it: scoped registry
     template: templates/gitea/deployment.yaml
     set:
-      image.registry: "example.com"
+      deployment.gitea.image.registry: "example.com"
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
@@ -55,9 +55,11 @@ tests:
   - it: digest for rootless image
     template: templates/gitea/deployment.yaml
     set:
-      image:
-        rootless: true
-        digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
+      deployment:
+        gitea:
+          image:
+            rootless: true
+            digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
@@ -65,14 +67,16 @@ tests:
   - it: image fullOverride (does not append rootless)
     template: templates/gitea/deployment.yaml
     set:
-      image:
-        fullOverride: docker.gitea.com/gitea:1.19.3
-        # setting rootless, registry, repository, tag, and digest to prove that override works
-        rootless: true
-        registry: example.com
-        repository: example/image
-        tag: "1.0.0"
-        digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
+      deployment:
+        gitea:
+          image:
+            fullOverride: docker.gitea.com/gitea:1.19.3
+            # setting rootless, registry, repository, tag, and digest to prove that override works
+            rootless: true
+            registry: example.com
+            repository: example/image
+            tag: "1.0.0"
+            digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
@@ -80,9 +84,11 @@ tests:
   - it: digest for root-based image
     template: templates/gitea/deployment.yaml
     set:
-      image:
-        rootless: false
-        digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
+      deployment:
+        gitea:
+          image:
+            rootless: false
+            digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
@@ -91,7 +97,7 @@ tests:
     template: templates/gitea/deployment.yaml
     set:
       global.imageRegistry: "global.example.com"
-      image.digest: "sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
+      deployment.gitea.image.digest: "sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
@@ -99,7 +105,7 @@ tests:
   - it: correctly renders floating tag references
     template: templates/gitea/deployment.yaml
     set:
-      image.tag: 1.21 # use non-quoted value on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
+      deployment.gitea.image.tag: 1.21 # use non-quoted value on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].image

unittests/helm/deployment/ssh-configuration.yaml

@@ -14,7 +14,7 @@ tests:
   - it: supports defining SSH log level for root based image
     template: templates/gitea/deployment.yaml
     set:
-      image.rootless: false
+      deployment.gitea.image.rootless: false
     asserts:
       - contains:
           path: spec.template.spec.containers[0].env
@@ -24,7 +24,7 @@ tests:
   - it: supports overriding SSH log level
     template: templates/gitea/deployment.yaml
     set:
-      image.rootless: false
+      deployment.gitea.image.rootless: false
       gitea.ssh.logLevel: "DEBUG"
     asserts:
       - contains:
@@ -35,8 +35,8 @@ tests:
   - it: supports overriding SSH log level (even when image.fullOverride set)
     template: templates/gitea/deployment.yaml
     set:
-      image.fullOverride: docker.gitea.com/gitea:1.19.3
-      image.rootless: false
+      deployment.gitea.image.fullOverride: docker.gitea.com/gitea:1.19.3
+      deployment.gitea.image.rootless: false
       gitea.ssh.logLevel: "DEBUG"
     asserts:
       - contains:
@@ -47,7 +47,7 @@ tests:
   - it: skips SSH_LOG_LEVEL for rootless image
     template: templates/gitea/deployment.yaml
     set:
-      image.rootless: true
+      deployment.gitea.image.rootless: true
       gitea.ssh.logLevel: "DEBUG" # explicitly defining a non-standard level here
     asserts:
       - notContains:
@@ -58,8 +58,8 @@ tests:
   - it: skips SSH_LOG_LEVEL for rootless image (even when image.fullOverride set)
     template: templates/gitea/deployment.yaml
     set:
-      image.fullOverride: docker.gitea.com/gitea:1.19.3
-      image.rootless: true
+      deployment.gitea.image.fullOverride: docker.gitea.com/gitea:1.19.3
+      deployment.gitea.image.rootless: true
       gitea.ssh.logLevel: "DEBUG" # explicitly defining a non-standard level here
     asserts:
       - notContains:

unittests/helm/init/init_directory_structure.sh-rootless.yaml

@@ -65,7 +65,7 @@ tests:
   - it: it does not chown /data even when image.fullOverride is set
     template: templates/gitea/secret_init.yaml
     set:
-      image.fullOverride: docker.gitea.com/gitea:1.20.5
+      deployment.gitea.image.fullOverride: docker.gitea.com/gitea:1.20.5
     asserts:
       - equal:
           path: stringData["init_directory_structure.sh"]

unittests/helm/init/init_directory_structure.sh.yaml

@@ -7,7 +7,7 @@ templates:
 tests:
   - it: runs gpg in batch mode
     set:
-      image.rootless: false
+      deployment.gitea.image.rootless: false
       secrets.gpg.enabled: true
       secrets.gpg.new.privateKey: |-
         -----BEGIN PGP PRIVATE KEY BLOCK-----
@@ -23,7 +23,7 @@ tests:
             gpg --batch --import "$TMP_RAW_GPG_KEY"
   - it: skips gpg script block for disabled signing
     set:
-      image.rootless: false
+      deployment.gitea.image.rootless: false
     asserts:
       - equal:
           path: stringData["init_directory_structure.sh"]
@@ -42,7 +42,7 @@ tests:
             chmod -v ug+rwx "${GITEA_TEMP}"
   - it: adds gpg script block for enabled signing
     set:
-      image.rootless: false
+      deployment.gitea.image.rootless: false
       secrets.gpg.enabled: true
       secrets.gpg.new.privateKey: |-
         -----BEGIN PGP PRIVATE KEY BLOCK-----