5 Commits

Include renames

Author	SHA1	Message	Date
volker.raschekandCopilot	eeacda2a25	test: align the file names of the helm unit tests with the chart conventions ... The chart conventions demand camelCase file names, forbid short names like `svc` and require the unit tests to mirror the template structure. The unit tests followed none of that consistently. Four casings existed side by side - camelCase (extraInitContainers.yaml), kebab-case (checksum-annotations.yaml), a snake and kebab mix (init_directory_structure.sh-rootless.yaml) and all caps (HA.yaml) - so there was no pattern to copy when adding a suite, which is how the inconsistency kept growing. Three groups of problems are fixed: - svc-configuration.yaml used exactly the short name the conventions forbid for files and keys. - Several file names repeated their own directory, for example deployment/deployment-additional-config.yaml and metric-secret/metrics-secret-servicemonitor-disabled.yaml, which names the subject three times. The directory already carries that information, so the file name now only carries the scenario. The default scenario of a template is named basics.yaml. - Four suites lived in a directory of a template they do not assert on. They were filed under deployment/ because the deployment is rendered as a side effect, not because it is the subject: deployment/deprecations.yaml -> deprecation/deployment.yaml deployment/inline-config.yaml -> config/inlineConfig.yaml deployment/storage-class-configuration.yaml -> persistentVolumeClaim/storageClass.yaml deployment/svc-configuration.yaml -> service/configuration.yaml storage-class-configuration.yaml is the clearest case: a persistentVolumeClaim directory already existed next to it. The suite titles of the two suites whose subject changed are adjusted accordingly. The Makefile passed `--file unittests/helm/values-conflicting-checks.yaml`, but that file does not exist in the tree. `helm unittest` ignores a missing path without a warning, so the flag has been dead for an unknown amount of time while still suggesting the checks run. It is removed; the `unittests/helm/**/*.yaml` glob would pick the file up anyway if it ever returns. The naming rule is written down in the copilot instructions, together with the constraint that the glob matches only a single directory level, so a suite can never be placed directly in unittests/helm/. All 49 suites and 267 tests still pass. Co-authored-by: Copilot <copilot@github.com>	2026-10-03 22:19:39 +02:00
volker.raschekandCopilot	fef4190a74	test: normalize the suite titles of the helm unit tests ... The contributor guidelines never defined how a `suite` title has to look, only how an `it` title has to look. Without a rule five competing schemes grew side by side: `config template | cache config`, `deployment template (probes)`, `ServiceMonitor template (basic)`, `Test Gateway API httpRoute.yaml` and `Dependency checks | Customization integrity | valkey`. 24 of the 49 titles started with a lowercase letter, which contradicts the sentence rule that already applies to the test titles. More than cosmetics, the missing rule produced three concrete defects: - `deployment template` was used by both deployment-additional-config.yaml and extraInitContainers.yaml, and `Init template` by both init_directory_structure.sh.yaml and its rootless counterpart. `helm unittest` identifies a failing suite by its title, so a failure in either file printed the same header and the report did not say which file to open. - deployment/inline-config.yaml was titled `config template`, although it lives in the deployment directory and asserts on secret_inlineConfig.yaml. It read like a sixth member of the `config template | ...` group. - persistentVolumeClaim.yaml was titled `PVC template`, using exactly the short name the chart conventions forbid for files and keys. All suites now follow `Test <subject> <scenario>`, for example `Test deployment probes` or `Test gateway API httpRoute`. The subject is the template under test, the scenario is what distinguishes the suite from its siblings, so every title is unique and sorts next to its related suites. The `Test ` prefix of the Gateway API, ingress and route suites is kept, because it is the only part of the old schemes that already read as a sentence; the redundant `.yaml` suffix and the `tests` suffix of the storage class suite are dropped. The rule is written down in the Unit Tests section of the copilot instructions, so the next suite does not have to guess which of the five schemes was meant. Co-authored-by: Copilot <copilot@github.com>	2026-10-03 21:21:46 +02:00
volker.raschekandCopilot	bb3b59f1ee	test: normalize the titles of the helm unit tests ... The contributor guidelines require that the title of a unit test is "a short sentence starting with a capital letter and ending without a period". Only 30 of the 269 titles followed that rule. The remaining ones were lowercase verb phrases ("renders a deployment"), which made the test output read inconsistently depending on which suite was running, and made it impossible to tell a convention violation from an intentional style. All titles are now imperative, capitalized and unquoted-safe: renders a deployment -> Render a Deployment should not render when gatewayAPI.enabled is false -> Skip rendering when gatewayAPI.enabled is false skips gpg volume spec -> Skip the gpg volume spec The bracketed prefixes of the dependency checks and of the server section suite are kept, because they group the tests by the chart they assert on. Only the sentence behind the prefix was rewritten. Beyond the pure capitalization three classes of titles needed real rewording: - The titles in image-configuration.yaml named a subject instead of a scenario ("default values", "tag override", "digest and global registry"). They now describe what is rendered. - init_directory_structure.sh-rootless.yaml carried "it does not chown /data ...", which rendered as "it it does not chown" in the test output. - The "should" prefix in the Gateway API and route suites added no information once the title is a sentence. The title of the GIT_GC_REPOS test lost its embedded double quotes. The title was previously an unquoted YAML scalar, so the quotes were literal characters; quoting the title turned them into a parse error. The value is unambiguous without them. Three byte-identical tests asserting pgpool.adminPassword existed in customization-integrity-postgresql-ha.yaml - same template, same assertion, same expected value. They were a copy-paste artifact and shared one title, so two of them are removed. No coverage is lost, which is why the test count drops from 269 to 267. No snapshot files are tracked and no suite uses matchSnapshot, so retitling cannot invalidate stored snapshots. Co-authored-by: Copilot <copilot@github.com>	2026-10-03 21:17:18 +02:00
volker.raschekandCopilot	552fe8c56e	refactor(templates): move the templates out of the gitea subdirectory ... The `templates/gitea` subdirectory did not group anything meaningful, since every template of this chart belongs to Gitea. It only duplicated the chart name in every path and forced the unit tests to spell out `templates/gitea/<name>.yaml`, while `_helpers.tpl` and `NOTES.txt` already lived directly in `templates`. All templates now live in `templates`, which matches the layout of the bundled sub-charts and the Helm defaults. The checksum helper in `templates/_secrets.tpl` built its include path from `$root.Template.BasePath` and therefore carried the subdirectory in a `printf` format string instead of a literal path. Without adjusting it the chart failed to render with "no template gitea/templates/gitea/secret_config.yaml associated with template gotpl". Co-authored-by: Copilot <copilot@github.com>	2026-09-14 20:28:17 +02:00
volker.raschekandCopilot	229ba12744	feat(secrets)!: replace the gitea.admin object with secrets.admin ... The admin user was the last piece of credential handling that lived outside of the `secrets` section. Worse, it was the only credential the chart rendered as a plain environment variable value into the Deployment: unless an existing Secret was referenced, username and password ended up in the pod spec in clear text, readable by anyone who can `get` or `describe` the Deployment. `gitea.admin` is therefore removed and fully replaced by `secrets.admin`: gitea.admin.username -> secrets.admin.new.username gitea.admin.password -> secrets.admin.new.password gitea.admin.email -> secrets.admin.new.email gitea.admin.passwordMode -> secrets.admin.passwordMode gitea.admin.existingSecret -> secrets.admin.existingSecret.{enabled,secretName} The chart now always creates a dedicated `<fullname>-admin` Secret and the Deployment consumes `GITEA_ADMIN_USERNAME`, `GITEA_ADMIN_PASSWORD` and `GITEA_ADMIN_EMAIL` via `secretKeyRef`. This removes the clear text credentials from the pod spec and makes the chart-managed and the externally provided case behave identically, which previously diverged. The email address moved into the Secret as well. It used to be interpolated directly into the init script, so changing it rewrote the init Secret, and an operator handing over admin credentials could not supply it. The key names of an externally provided Secret are configurable via `secrets.admin.existingSecret.{emailKey,passwordKey,usernameKey}`, because chart-defined key names cannot be assumed for Secrets managed by an external system such as a secret store. Admin handling was previously skipped implicitly when neither an existing Secret nor a username and password were set. This implicit behaviour is replaced by the explicit `secrets.admin.enabled` flag, so disabling it no longer requires blanking out unrelated values. `gitea.admin.passwordMode` validation moved from `_helpers.tpl` to `_secrets.tpl` as `gitea.secret.admin.passwordMode` to keep all Secret related helpers in one place. `deprecation.yaml` fails the render when `gitea.admin` is still set and points to `secrets.admin`. New test suites cover the rendered admin Secret, the `secretKeyRef` wiring, custom key names of an existing Secret and the password mode validation. The `secret_admin.yaml` template is registered in every suite that renders the Deployment, as helm-unittest requires templates referenced via `$.Template.BasePath` to be listed explicitly. BREAKING CHANGE: The `gitea.admin` object has been removed and is replaced by `secrets.admin`. Rendering fails if `gitea.admin` is still set. Secrets referenced via `secrets.admin.existingSecret` now additionally require an `email` key next to `username` and `password`. Co-authored-by: Copilot <copilot@github.com>	2026-09-03 20:43:53 +02:00