fix(secrets): render config and init secrets as data to prune removed keys

Both Secrets rendered their payload via `stringData`. That field is write-only: the API server decodes it into
`data` and does not persist `stringData` itself. Helm's three-way merge therefore generates a deletion patch
that targets `stringData`, while the live object only ever carries `data` - so a key that disappears from the
rendered manifest is never pruned and survives every upgrade.

Unlike the inline-config Secret fixed in #1110, the keys here are driven by the files in
`scripts/init-containers/**` rather than by user values, so the bug is latent rather than acute. It still
bites whenever a script is removed or renamed in the chart: the stale key stays in the Secret and keeps being
mounted into the init containers.

The two inline scripts of the init Secret were YAML block scalars and had to be moved into `define` blocks to
be pipeable through `b64enc`. The bodies are dedented by four columns accordingly, and `trimAll "\n"`
reproduces the chomping semantics of the previous `|-` scalars. Rendering was diffed against the previous
revision for defaults, rootless, initPreScript, GPG, admin, LDAP, OAuth and all valkey variants - the decoded
payloads are byte-identical, so no init script changes behaviour.

Unit tests now read the payloads from `data.*` with `decodeBase64: true` and assert that `stringData` no
longer exists, to catch a regression early.

See: https://gitea.com/gitea/helm-gitea/issues/1109
See: https://gitea.com/gitea/helm-gitea/pulls/1110

Co-authored-by: Copilot <copilot@github.com>

templates/secret_config.yaml

@@ -14,10 +14,9 @@ metadata:
   name: {{ include "gitea.secret.config.name" . }}
   namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
-stringData:
-{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
-  assertions: |
-    {{- $assertions | nindent 4 }}
+data:
+{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsSecrets | indent 2 }}
+  assertions: {{ $assertions | b64enc | quote }}
 {{- end }}
 
 {{- define "gitea.config.assertions" -}}

templates/secret_init.yaml

@@ -11,9 +11,13 @@ metadata:
   name: {{ include "gitea.secret.init.name" . }}
   namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
-stringData:
-{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
-  init_directory_structure.sh: |-
+data:
+{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsSecrets | indent 2 }}
+  configure_gitea.sh: {{ include "gitea.init.configureGitea" . | trimAll "\n" | b64enc | quote }}
+  init_directory_structure.sh: {{ include "gitea.init.initDirectoryStructure" . | trimAll "\n" | b64enc | quote }}
+{{- end }}
+
+{{- define "gitea.init.initDirectoryStructure" -}}
 #!/usr/bin/env bash
 
 set -euo pipefail
@@ -21,7 +25,7 @@ stringData:
 {{- if .Values.initPreScript }}
 # BEGIN: initPreScript
 {{- with .Values.initPreScript -}}
-    {{ . | nindent 4}}
+{{ . | nindent 0 }}
 {{- end -}}
 # END: initPreScript
 {{- end }}
@@ -47,8 +51,9 @@ stringData:
   chown -v 1000:1000 "${GNUPGHOME}"
 fi
 {{- end }}
+{{- end }}
 
-  configure_gitea.sh: |-
+{{- define "gitea.init.configureGitea" -}}
 #!/usr/bin/env bash
 
 set -euo pipefail

unittests/helm/config/config-environment-script.yaml

@@ -11,5 +11,15 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData["config_environment.sh"]
+          path: data["config_environment.sh"]
+          decodeBase64: true
           pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'
+  - it: renders data, not stringData, so removed keys are pruned on upgrade
+    template: templates/secret_config.yaml
+    asserts:
+      - documentIndex: 0
+        notExists:
+          path: stringData
+      - documentIndex: 0
+        exists:
+          path: data["config_environment.sh"]

unittests/helm/dependency-checks/customization-integrity-valkey.yaml

@@ -39,7 +39,8 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData["configure_gitea.sh"]
+          path: data["configure_gitea.sh"]
+          decodeBase64: true
           pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379
   - it: "[gitea] waits for valkey to be up and running with custom cluster domain"
     set:
@@ -48,5 +49,6 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData["configure_gitea.sh"]
+          path: data["configure_gitea.sh"]
+          decodeBase64: true
           pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379

unittests/helm/init/init_directory_structure.sh-rootless.yaml

@@ -14,7 +14,8 @@ tests:
         -----END PGP PRIVATE KEY BLOCK-----
     asserts:
       - equal:
-          path: stringData["configure_gpg_environment.sh"]
+          path: data["configure_gpg_environment.sh"]
+          decodeBase64: true
           value: |
             #!/usr/bin/env bash
             set -eu
@@ -23,7 +24,8 @@ tests:
   - it: skips gpg script block for disabled signing
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -44,7 +46,8 @@ tests:
         -----END PGP PRIVATE KEY BLOCK-----
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -68,7 +71,8 @@ tests:
       deployment.gitea.image.fullOverride: docker.gitea.com/gitea:1.20.5
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -80,3 +84,9 @@ tests:
             # prepare temp directory structure
             mkdir -pv "${GITEA_TEMP}"
             chmod -v ug+rwx "${GITEA_TEMP}"
+  - it: renders data, not stringData, so removed keys are pruned on upgrade
+    asserts:
+      - notExists:
+          path: stringData
+      - exists:
+          path: data["init_directory_structure.sh"]

unittests/helm/init/init_directory_structure.sh.yaml

@@ -15,7 +15,8 @@ tests:
         -----END PGP PRIVATE KEY BLOCK-----
     asserts:
       - equal:
-          path: stringData["configure_gpg_environment.sh"]
+          path: data["configure_gpg_environment.sh"]
+          decodeBase64: true
           value: |
             #!/usr/bin/env bash
             set -eu
@@ -26,7 +27,8 @@ tests:
       deployment.gitea.image.rootless: false
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -50,7 +52,8 @@ tests:
         -----END PGP PRIVATE KEY BLOCK-----
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -70,3 +73,11 @@ tests:
               chmod -v 700 "${GNUPGHOME}"
               chown -v 1000:1000 "${GNUPGHOME}"
             fi
+  - it: renders data, not stringData, so removed keys are pruned on upgrade
+    set:
+      deployment.gitea.image.rootless: false
+    asserts:
+      - notExists:
+          path: stringData
+      - exists:
+          path: data["init_directory_structure.sh"]