volker.raschekandCopilot 6025d82333 docs(copilot): require Secret payloads to be rendered as data ...

The inline-config Secret rendered its payload via `stringData`. That field is write-only: the API server
decodes it into `data` and does not persist `stringData` itself. As a result Helm's three-way merge could
never prune a key that was removed from the values, because the generated patch targets `stringData` while
the live object only has `data`. Stale sections therefore survived every upgrade and the init container kept
writing them back into `app.ini` on each start.

To prevent this class of bug from being reintroduced, document the rule explicitly: render Secret payloads as
base64 `data`, and assert Secret content in unit tests via `data.*` with `decodeBase64: true` plus a
`notExists` assertion for `stringData`.

See: https://gitea.com/gitea/helm-gitea/issues/1109
See: https://gitea.com/gitea/helm-gitea/pulls/1110

Co-authored-by: Copilot <copilot@github.com>

2026-10-03 17:19:00 +02:00

..

copilot-instructions.md

docs(copilot): require Secret payloads to be rendered as data

2026-10-03 17:19:00 +02:00