From 78918b88f01beb7e9ef1bcea1adf6c34c3c085eb Mon Sep 17 00:00:00 2001
From: DaanSelen <135789+daanselen@noreply.gitea.com>
Date: Wed, 1 Apr 2026 14:31:31 +0000
Subject: [PATCH] feat: add dry templating to existingSecret (#112)

Successor to: https://gitea.com/gitea/helm-actions/pulls/77

---------

Co-authored-by: DaanSelen <dselen@systemec.nl>
Reviewed-on: https://gitea.com/gitea/helm-actions/pulls/112
Reviewed-by: wxiaoguang <29147+wxiaoguang@noreply.gitea.com>
---
 templates/statefulset.yaml      |  4 ++--
 unittests/helm/statefulset.yaml | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/templates/statefulset.yaml b/templates/statefulset.yaml
index 8cbcf3c..c965810 100644
--- a/templates/statefulset.yaml
+++ b/templates/statefulset.yaml
@@ -84,8 +84,8 @@ spec:
             - name: GITEA_RUNNER_REGISTRATION_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: "{{ .Values.existingSecret | default $secretName }}"
-                  key: "{{ .Values.existingSecretKey | default "token" }}"
+                  name: "{{ (tpl .Values.existingSecret . ) | default $secretName }}"
+                  key: "{{ (tpl .Values.existingSecretKey . ) | default "token" }}"
             - name: GITEA_INSTANCE_URL
               value: {{ include "gitea.actions.local_root_url" . }}
             - name: CONFIG_FILE
diff --git a/unittests/helm/statefulset.yaml b/unittests/helm/statefulset.yaml
index c863120..119e14e 100644
--- a/unittests/helm/statefulset.yaml
+++ b/unittests/helm/statefulset.yaml
@@ -429,6 +429,33 @@ tests:
           content:
             mountPath: /mnt
             name: my-dind-volume
+  - it: should interpret existingSecret & existingSecretKey templating
+    template: templates/statefulset.yaml
+    set:
+      gitea:
+        token:
+          secret:
+            name: "gitea-secret"
+            key: "secret-key"
+      enabled: true
+      existingSecret: "{{ .Release.Name }}-{{ .Values.gitea.token.secret.name}}"
+      existingSecretKey: "{{ .Values.gitea.token.secret.key}}"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].env[0].name
+          value: "GITEA_RUNNER_REGISTRATION_TOKEN"
+      - equal:
+          path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.name
+          value: "gitea-unittests-gitea-secret"
+      - equal:
+          path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.key
+          value: "secret-key"
   - it: should interpret Gitea Root URL templating
     template: templates/statefulset.yaml
     set: