chore(deps): update docker.io/volkerraschek/helm docker tag to v4

The reposilite entrypoint chowns /app to 977:977 whenever it starts as root. The plugin container downloaded
the jar as its own image user (101), so after the first start the file was owned by 977:977 with mode 0644.
Since the plugins emptyDir survives a container restart within the same pod, a restarted plugin container
could no longer overwrite the existing jar and aborted with "Permission denied", which left the pod in a
permanent Init:CrashLoopBackOff until the pod itself was recreated.

Run the plugin container as 977:977 by default and expose the security context as
deployment.pluginContainer.securityContext, so it can be aligned when PUID/PGID are overridden.

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/generate-readme.yaml

@@ -15,14 +15,14 @@ on:
 jobs:
   generate-parameters:
     container:
-      image: docker.io/library/node:26.3.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling
       run: |
         apk update
         apk add git npm
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Generate parameter section in README
       run: |
         npm install

.gitea/workflows/helm.yaml

@@ -14,10 +14,10 @@ jobs:
   helm-lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
-        version: v4.1.4 # renovate: datasource=github-releases depName=helm/helm
+        version: v4.3.1 # renovate: datasource=github-releases depName=helm/helm
     - name: Lint helm files
       run: |
         helm lint --values values.yaml .
@@ -25,10 +25,10 @@ jobs:
   helm-unittest:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
-        version: v4.1.4 # renovate: datasource=github-releases depName=helm/helm
+        version: v4.3.1 # renovate: datasource=github-releases depName=helm/helm
     - env:
         HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
       name: Install helm-unittest

.gitea/workflows/markdown-linters.yaml

@@ -15,14 +15,14 @@ on:
 jobs:
   markdown-link-checker:
     container:
-      image: docker.io/library/node:26.3.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling
       run: |
         apk update
         apk add git npm
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Verify links in markdown files
       run: |
         npm install
@@ -30,14 +30,14 @@ jobs:
 
   markdown-lint:
     container:
-      image: docker.io/library/node:26.3.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling
       run: |
         apk update
         apk add git
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Lint markdown files
       run: |
         npm install

.gitea/workflows/release.yaml

@@ -8,7 +8,7 @@ on:
 jobs:
   publish-chart:
     container:
-      image: docker.io/volkerraschek/helm:3.19.2
+      image: docker.io/volkerraschek/helm:4.3.1
     runs-on: ubuntu-latest
     steps:
       - name: Install packages via apk
@@ -16,7 +16,7 @@ jobs:
           apk update
           apk add git npm jq yq
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

.vscode/settings.json

@@ -1,6 +1,6 @@
 {
   "yaml.schemas": {
-    "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.1.1/schema/helm-testsuite.json": [
+    "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.2.1/schema/helm-testsuite.json": [
       "/unittests/**/*.yaml"
     ]
   },

Chart.yaml

@@ -5,7 +5,7 @@ annotations:
     - name: support
       url: https://git.cryptic.systems/volker.raschek/reposilite-charts/issues
 apiVersion: v2
-appVersion: "3.5.28"
+appVersion: "3.6.5"
 description: |
   Lightweight and easy-to-use repository management software
   dedicated for the Maven based artifacts in the JVM ecosystem

README.md

@@ -37,7 +37,7 @@ version of the chart must be in sync with the `values.yaml`. Newer *minor* versi
 versions can break something!
 
 ```bash
-CHART_VERSION=1.0.0
+CHART_VERSION=1.0.1
 helm show values volker.raschek/reposilite --version "${CHART_VERSION}" > values.yaml
 ```
 
@@ -51,7 +51,7 @@ The helm chart also contains a persistent volume claim definition. It persistent
 Use the `--set` argument to persist your data.
 
 ```bash
-CHART_VERSION=1.0.0
+CHART_VERSION=1.0.1
 helm install --version "${CHART_VERSION}" reposilite volker.raschek/reposilite \
   persistentVolumeClaim.enabled=true
 ```
@@ -72,7 +72,7 @@ connection problems.
 > error.
 
 ```bash
-CHART_VERSION=1.0.0
+CHART_VERSION=1.0.1
 helm install --version "${CHART_VERSION}" reposilite volker.raschek/reposilite \
   --set 'deployment.reposilite.env[1].name=REPOSILITE_LOCAL_SSLENABLED' \
   --set 'deployment.reposilite.env[1].value="true"' \
@@ -196,7 +196,7 @@ be set the credentials manually.
 The following example enable Prometheus metrics with custom basic auth credentials:
 
 ```bash
-CHART_VERSION=1.0.0
+CHART_VERSION=1.0.1
 helm install --version "${CHART_VERSION}" reposilite volker.raschek/reposilite \
   --set 'prometheus.metrics.enabled=true' \
   --set 'prometheus.metrics.basicAuthUsername=my-username' \
@@ -270,47 +270,49 @@ spec:
 
 ### Deployment
 
-| Name                                               | Description                                                                                                | Value                                       |
+| Name                                                    | Description                                                                                                | Value                                       |
-| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
+| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
-| `deployment.annotations`                           | Additional deployment annotations.                                                                         | `{}`                                        |
+| `deployment.annotations`                                | Additional deployment annotations.                                                                         | `{}`                                        |
-| `deployment.labels`                                | Additional deployment labels.                                                                              | `{}`                                        |
+| `deployment.labels`                                     | Additional deployment labels.                                                                              | `{}`                                        |
-| `deployment.additionalContainers`                  | List of additional containers.                                                                             | `[]`                                        |
+| `deployment.additionalContainers`                       | List of additional containers.                                                                             | `[]`                                        |
-| `deployment.affinity`                              | Affinity for the Reposilite deployment.                                                                    | `{}`                                        |
+| `deployment.affinity`                                   | Affinity for the Reposilite deployment.                                                                    | `{}`                                        |
-| `deployment.initContainers`                        | List of additional init containers.                                                                        | `[]`                                        |
+| `deployment.initContainers`                             | List of additional init containers.                                                                        | `[]`                                        |
-| `deployment.dnsConfig`                             | dnsConfig of the Reposilite deployment.                                                                    | `{}`                                        |
+| `deployment.dnsConfig`                                  | dnsConfig of the Reposilite deployment.                                                                    | `{}`                                        |
-| `deployment.dnsPolicy`                             | dnsPolicy of the Reposilite deployment.                                                                    | `""`                                        |
+| `deployment.dnsPolicy`                                  | dnsPolicy of the Reposilite deployment.                                                                    | `""`                                        |
-| `deployment.hostname`                              | Individual hostname of the pod.                                                                            | `""`                                        |
+| `deployment.hostname`                                   | Individual hostname of the pod.                                                                            | `""`                                        |
-| `deployment.subdomain`                             | Individual domain of the pod.                                                                              | `""`                                        |
+| `deployment.subdomain`                                  | Individual domain of the pod.                                                                              | `""`                                        |
-| `deployment.hostNetwork`                           | Use the kernel network namespace of the host system.                                                       | `false`                                     |
+| `deployment.hostNetwork`                                | Use the kernel network namespace of the host system.                                                       | `false`                                     |
-| `deployment.imagePullSecrets`                      | Secret to use for pulling the image.                                                                       | `[]`                                        |
+| `deployment.imagePullSecrets`                           | Secret to use for pulling the image.                                                                       | `[]`                                        |
-| `deployment.reposilite.args`                       | Arguments passed to the Reposilite container.                                                              | `[]`                                        |
+| `deployment.reposilite.args`                            | Arguments passed to the Reposilite container.                                                              | `[]`                                        |
-| `deployment.reposilite.command`                    | Command passed to the Reposilite container.                                                                | `[]`                                        |
+| `deployment.reposilite.command`                         | Command passed to the Reposilite container.                                                                | `[]`                                        |
-| `deployment.reposilite.env`                        | List of environment variables for the Reposilite container.                                                |                                             |
+| `deployment.reposilite.env`                             | List of environment variables for the Reposilite container.                                                |                                             |
-| `deployment.reposilite.envFrom`                    | List of environment variables mounted from configMaps or secrets for the Reposilite container.             | `[]`                                        |
+| `deployment.reposilite.envFrom`                         | List of environment variables mounted from configMaps or secrets for the Reposilite container.             | `[]`                                        |
-| `deployment.reposilite.image.registry`             | Image registry, eg. `docker.io`.                                                                           | `docker.io`                                 |
+| `deployment.reposilite.image.registry`                  | Image registry, eg. `docker.io`.                                                                           | `docker.io`                                 |
-| `deployment.reposilite.image.repository`           | Image repository, eg. `library/busybox`.                                                                   | `dzikoysk/reposilite`                       |
+| `deployment.reposilite.image.repository`                | Image repository, eg. `library/busybox`.                                                                   | `dzikoysk/reposilite`                       |
-| `deployment.reposilite.image.tag`                  | Custom image tag, eg. `0.1.0`. Defaults to `appVersion`.                                                   | `""`                                        |
+| `deployment.reposilite.image.tag`                       | Custom image tag, eg. `0.1.0`. Defaults to `appVersion`.                                                   | `""`                                        |
-| `deployment.reposilite.image.pullPolicy`           | Image pull policy.                                                                                         | `IfNotPresent`                              |
+| `deployment.reposilite.image.pullPolicy`                | Image pull policy.                                                                                         | `IfNotPresent`                              |
-| `deployment.reposilite.resources`                  | CPU and memory resources of the pod.                                                                       | `{}`                                        |
+| `deployment.reposilite.resources`                       | CPU and memory resources of the pod.                                                                       | `{}`                                        |
-| `deployment.reposilite.securityContext`            | Security context of the container of the deployment.                                                       | `{}`                                        |
+| `deployment.reposilite.securityContext`                 | Security context of the container of the deployment.                                                       | `{}`                                        |
-| `deployment.reposilite.volumeMounts`               | Additional volume mounts.                                                                                  | `[]`                                        |
+| `deployment.reposilite.volumeMounts`                    | Additional volume mounts.                                                                                  | `[]`                                        |
-| `deployment.nodeSelector`                          | NodeSelector of the Reposilite deployment.                                                                 | `{}`                                        |
+| `deployment.nodeSelector`                               | NodeSelector of the Reposilite deployment.                                                                 | `{}`                                        |
-| `deployment.pluginContainer.args`                  | Arguments passed to the plugin container.                                                                  | `["--location","--fail","--max-time","60"]` |
+| `deployment.pluginContainer.args`                       | Arguments passed to the plugin container.                                                                  | `["--location","--fail","--max-time","60"]` |
-| `deployment.pluginContainer.image.registry`        | Image registry, eg. `docker.io`.                                                                           | `docker.io`                                 |
+| `deployment.pluginContainer.image.registry`             | Image registry, eg. `docker.io`.                                                                           | `docker.io`                                 |
-| `deployment.pluginContainer.image.repository`      | Image repository, eg. `curlimages/curl`.                                                                   | `curlimages/curl`                           |
+| `deployment.pluginContainer.image.repository`           | Image repository, eg. `curlimages/curl`.                                                                   | `curlimages/curl`                           |
-| `deployment.pluginContainer.image.tag`             | Custom image tag, eg. `0.1.0`.                                                                             | `8.20.0`                                    |
+| `deployment.pluginContainer.image.tag`                  | Custom image tag, eg. `0.1.0`.                                                                             | `8.23.0`                                    |
-| `deployment.pluginContainer.image.pullPolicy`      | Image pull policy.                                                                                         | `IfNotPresent`                              |
+| `deployment.pluginContainer.image.pullPolicy`           | Image pull policy.                                                                                         | `IfNotPresent`                              |
-| `deployment.priorityClassName`                     | PriorityClassName of the Reposilite deployment.                                                            | `""`                                        |
+| `deployment.pluginContainer.securityContext.runAsGroup` | Group id of the plugin container.                                                                          | `977`                                       |
-| `deployment.replicas`                              | Number of replicas for the Reposilite deployment.                                                          | `1`                                         |
+| `deployment.pluginContainer.securityContext.runAsUser`  | User id of the plugin container.                                                                           | `977`                                       |
-| `deployment.restartPolicy`                         | Restart policy of the Reposilite deployment.                                                               | `""`                                        |
+| `deployment.priorityClassName`                          | PriorityClassName of the Reposilite deployment.                                                            | `""`                                        |
-| `deployment.securityContext`                       | Security context of the Reposilite deployment.                                                             | `{}`                                        |
+| `deployment.replicas`                                   | Number of replicas for the Reposilite deployment.                                                          | `1`                                         |
-| `deployment.strategy.type`                         | Strategy type - `Recreate` or `RollingUpdate`.                                                             | `RollingUpdate`                             |
+| `deployment.restartPolicy`                              | Restart policy of the Reposilite deployment.                                                               | `""`                                        |
-| `deployment.strategy.rollingUpdate.maxSurge`       | The maximum number of pods that can be scheduled above the desired number of pods during a rolling update. | `1`                                         |
+| `deployment.securityContext`                            | Security context of the Reposilite deployment.                                                             | `{}`                                        |
-| `deployment.strategy.rollingUpdate.maxUnavailable` | The maximum number of pods that can be unavailable during a rolling update.                                | `1`                                         |
+| `deployment.strategy.type`                              | Strategy type - `Recreate` or `RollingUpdate`.                                                             | `RollingUpdate`                             |
-| `deployment.terminationGracePeriodSeconds`         | How long to wait until forcefully kill the pod.                                                            | `60`                                        |
+| `deployment.strategy.rollingUpdate.maxSurge`            | The maximum number of pods that can be scheduled above the desired number of pods during a rolling update. | `1`                                         |
-| `deployment.tolerations`                           | Tolerations of the Reposilite deployment.                                                                  | `[]`                                        |
+| `deployment.strategy.rollingUpdate.maxUnavailable`      | The maximum number of pods that can be unavailable during a rolling update.                                | `1`                                         |
-| `deployment.topologySpreadConstraints`             | TopologySpreadConstraints of the Reposilite deployment.                                                    | `[]`                                        |
+| `deployment.terminationGracePeriodSeconds`              | How long to wait until forcefully kill the pod.                                                            | `60`                                        |
-| `deployment.volumes`                               | Additional volumes to mount into the pods of the reposilite deployment.                                    | `[]`                                        |
+| `deployment.tolerations`                                | Tolerations of the Reposilite deployment.                                                                  | `[]`                                        |
+| `deployment.topologySpreadConstraints`                  | TopologySpreadConstraints of the Reposilite deployment.                                                    | `[]`                                        |
+| `deployment.volumes`                                    | Additional volumes to mount into the pods of the reposilite deployment.                                    | `[]`                                        |
 
 ### Horizontal Pod Autoscaler (HPA)
 

package.json

@@ -16,6 +16,6 @@
   "devDependencies": {
     "@bitnami/readme-generator-for-helm": "^2.5.0",
     "markdown-link-check": "^3.13.6",
-    "markdownlint-cli": "^0.48.0"
+    "markdownlint-cli": "^0.50.0"
   }
 }

renovate.json

@@ -15,7 +15,7 @@
         "^Chart\\.yaml$"
       ],
       "matchStrings": [
-        "appVersion: \"(?<currentValue>.*?)\"\\s+"
+        "appVersion: \"?(?<currentValue>[^\"\\s]+)\"?\\s*"
       ],
       "datasourceTemplate": "docker",
       "depNameTemplate": "dzikoysk/reposilite",

templates/_deployment.tpl

@@ -71,7 +71,11 @@
 {{- if eq (include "reposilite.plugins.prometheus.enabled" $) "true" }}
 {{- $fileName := splitList "/" (tpl .Values.config.plugins.prometheus.url $) | last }}
 {{- $individualArgs := concat $pluginContainerArgs (list "--output" $fileName (tpl .Values.config.plugins.prometheus.url $)) }}
-{{- $initContainers = concat $initContainers (list (dict "args" $individualArgs "name" "download-prometheus-plugin" "image" $pluginContainerImage "volumeMounts" $pluginContainerVolumeMounts)) }}
+{{- $pluginContainer := dict "args" $individualArgs "name" "download-prometheus-plugin" "image" $pluginContainerImage "volumeMounts" $pluginContainerVolumeMounts }}
+{{- with .Values.deployment.pluginContainer.securityContext }}
+{{- $_ := set $pluginContainer "securityContext" . }}
+{{- end }}
+{{- $initContainers = concat $initContainers (list $pluginContainer) }}
 {{- end }}
 
 {{ toYaml (dict "initContainers" $initContainers) }}

unittests/deployment/configPlugins.yaml

@@ -30,6 +30,9 @@ tests:
         - https://reposilite.com/plugins/prometheus.jar
         name: download-prometheus-plugin
         image: docker.io/curlimages/curl:0.1.0
+        securityContext:
+          runAsGroup: 977
+          runAsUser: 977
         volumeMounts:
         - mountPath: /app/data/plugins
           name: plugins

values.yaml

@@ -175,9 +175,18 @@ deployment:
     image:
       registry: docker.io
       repository: curlimages/curl
-      tag: "8.20.0"
+      tag: "8.23.0"
       pullPolicy: IfNotPresent
 
+    ## @param deployment.pluginContainer.securityContext.runAsGroup Group id of the plugin container.
+    ## @param deployment.pluginContainer.securityContext.runAsUser User id of the plugin container.
+    # Reposilite chowns /app to 977:977 when its entrypoint starts as root. Downloading the plugin as a
+    # different user leaves behind a file the plugin container can no longer overwrite, which breaks every
+    # restart that reuses the emptyDir. Align this with PUID/PGID when those are overridden.
+    securityContext:
+      runAsGroup: 977
+      runAsUser: 977
+
   ## @param deployment.priorityClassName PriorityClassName of the Reposilite deployment.
   priorityClassName: ""