chore(deps): update lockfiles (#131)

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMTYiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMTAuMTYiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImtpbmQvZGVwZW5kZW5jeSJdfQ==-->

Reviewed-on: https://gitea.com/gitea/helm-actions/pulls/131
Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
Co-committed-by: Renovate Bot <renovate-bot@gitea.com>

.gitea/workflows/release-version.yml

@@ -7,7 +7,7 @@ on:
 
 env:
   # renovate: datasource=docker depName=alpine/helm
-  HELM_VERSION: "4.1.3"
+  HELM_VERSION: "4.1.4"
 
 jobs:
   generate-chart-publish:

.gitea/workflows/test-pr.yml

@@ -16,14 +16,14 @@ env:
 jobs:
   check-and-test:
     runs-on: ubuntu-latest
-    container: alpine/helm:4.1.3
+    container: alpine/helm:4.1.4
     steps:
       - name: install tools
         run: |
           apk update
           apk add --update bash make nodejs npm yamllint ncurses
       - name: Install pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@v6
         with:
           version: 10
       - uses: actions/checkout@v6

README.md

@@ -80,8 +80,9 @@ If `.Values.statefulset.dind.rootless: true` is set, then the following will be
 | `statefulset.actRunner.pullPolicy`        | The Gitea act runner pullPolicy                                                                                                             | `IfNotPresent`                 |
 | `statefulset.actRunner.fullOverride`      | Completely overrides the image registry, path/image, tag and digest.                                                                        | `""`                           |
 | `statefulset.actRunner.extraVolumeMounts` | Allows mounting extra volumes in the act runner container                                                                                   | `[]`                           |
-| `statefulset.actRunner.config`            | Act runner custom configuration. See [Act Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details. | `Too complex. See values.yaml` |
 | `statefulset.actRunner.extraEnvs`         | Allows adding custom environment variables                                                                                                  | `[]`                           |
+| `statefulset.actRunner.flushCache`        | whether to clear the .runner (cache) file by creating an extra init container, can slightly increase boot-up time                           | `false`                        |
+| `statefulset.actRunner.config`            | Act runner custom configuration. See [Act Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details. | `Too complex. See values.yaml` |
 | `statefulset.dind.rootless`               | a simple flag to let helm know we are dealing with a rootless dind container                                                                | `false`                        |
 | `statefulset.dind.uid`                    | a field to set the running user id for the rootless dind container, so it knows where to look for the socket                                | `""`                           |
 | `statefulset.dind.registry`               | image registry, e.g. gcr.io,docker.io                                                                                                       | `docker.io`                    |

pnpm-lock.yaml

@@ -47,8 +47,8 @@ packages:
     resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
     engines: {node: 18 || 20 || >=22}
 
-  brace-expansion@1.1.13:
+  brace-expansion@1.1.14:
-    resolution: {integrity: sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==}
+    resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==}
 
   brace-expansion@5.0.5:
     resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==}
@@ -373,7 +373,7 @@ snapshots:
 
   balanced-match@4.0.4: {}
 
-  brace-expansion@1.1.13:
+  brace-expansion@1.1.14:
     dependencies:
       balanced-match: 1.0.2
       concat-map: 0.0.1
@@ -702,7 +702,7 @@ snapshots:
 
   minimatch@3.1.5:
     dependencies:
-      brace-expansion: 1.1.13
+      brace-expansion: 1.1.14
 
   minimist@1.2.8: {}
 

templates/_helpers.tpl

@@ -14,14 +14,14 @@ If release name contains chart name it will be used as a full name.
 */}}
 {{- define "gitea.actions.fullname" -}}
 {{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+  {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
 {{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
+  {{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
+  {{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+    {{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
+    {{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+    {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
+  {{- end -}}
 {{- end -}}
 {{- end -}}
 
@@ -36,7 +36,7 @@ Create a default worker name.
 Create chart name and version as used by the chart label.
 */}}
 {{- define "gitea.actions.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+  {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
 {{/*
@@ -45,7 +45,7 @@ Storage Class
 {{- define "gitea.actions.persistence.storageClass" -}}
 {{- $storageClass :=  default (tpl ( default "" .Values.global.storageClass) .) }}
 {{- if $storageClass }}
-storageClassName: {{ $storageClass | quote }}
+  storageClassName: {{ $storageClass | quote }}
 {{- end }}
 {{- end -}}
 

templates/config-act-runner.yaml

@@ -11,9 +11,9 @@ data:
   config.yaml: |
     {{- with .Values.statefulset.actRunner.config -}}
     {{- if kindIs "string" . -}}
-    {{ . | nindent 4}}
+      {{ . | nindent 4}}
     {{- else -}}
-    {{ toYaml . | nindent 4}}
+      {{ toYaml . | nindent 4}}
     {{- end -}}
     {{- end -}}
 {{- end }}

templates/statefulset.yaml

@@ -32,14 +32,14 @@ spec:
     spec:
       restartPolicy: Always
       {{- if .Values.statefulset.serviceAccountName }}
-      serviceAccountName: {{ .Values.statefulset.serviceAccountName }}
+      serviceAccountName: {{ .Values.statefulset.serviceAccountName | quote }}
       {{- end }}
       {{- if .Values.statefulset.securityContext }}
       securityContext:
         {{- toYaml .Values.statefulset.securityContext | nindent 8 }}
       {{- end }}
       {{- if .Values.statefulset.runtimeClassName }}
-        runtimeClassName: {{ .Values.statefulset.runtimeClassName }}
+      runtimeClassName: {{ .Values.statefulset.runtimeClassName | quote }}
       {{- end }}
       {{- if .Values.statefulset.hostAliases }}
       hostAliases:
@@ -49,6 +49,23 @@ spec:
         {{- if .Values.preExtraInitContainers }}
         {{- toYaml .Values.preExtraInitContainers | nindent 8 }}
         {{- end }}
+        {{- if .Values.statefulset.actRunner.flushCache }}
+        - name: cache-flusher
+          image: "{{ include "gitea.actions.init.image" . }}"
+          command:
+            - sh
+            - -c
+            - |
+              if [[ -f /data/.runner ]]; then
+                echo "Removing cache at /data/.runner"
+                rm -v /data/.runner
+              else
+                echo "No .runner file to remove"
+              fi
+          volumeMounts:
+            - mountPath: /data
+              name: data-act-runner
+        {{- end }}
         - name: init-gitea
           image: "{{ include "gitea.actions.init.image" . }}"
           command:
@@ -176,9 +193,7 @@ spec:
         name: data-act-runner
       spec:
         accessModes: [ "ReadWriteOnce" ]
-        {{- if .Values.global.storageClass }}
+        {{- include "gitea.actions.persistence.storageClass" . | nindent 8 }}
-        {{- include "gitea.actions.persistence.storageClass" . | indent 8 }}
-        {{- end }}
         resources:
           requests:
             storage: {{ .Values.statefulset.persistence.size }}

unittests/helm/01-consistency-checks.yaml

@@ -1,6 +1,6 @@
 suite: actions template | consistency checks
 release:
-  name: gitea-unittests
+  name: gitea-actions-unittests
   namespace: testing
 templates:
   - templates/01-consistency-checks.yaml

unittests/helm/config-act-runner.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
 suite: actions template | config-act-runner
 release:
-  name: gitea-unittests
+  name: gitea-actions-unittests
   namespace: testing
 templates:
   - templates/config-act-runner.yaml
@@ -31,7 +31,7 @@ tests:
       - containsDocument:
           kind: ConfigMap
           apiVersion: v1
-          name: gitea-unittests-actions-act-runner-config
+          name: gitea-actions-unittests-act-runner-config
       - equal:
           path: data["config.yaml"]
           value: |
@@ -59,7 +59,7 @@ tests:
       - containsDocument:
           kind: ConfigMap
           apiVersion: v1
-          name: gitea-unittests-actions-act-runner-config
+          name: gitea-actions-unittests-act-runner-config
       - matchRegex:
           path: data["config.yaml"]
           pattern: '(?m)^\s*options:\s*-v /var/run/docker.sock:/var/run/docker.sock\s*$'

unittests/helm/statefulset.yaml

@@ -1,17 +1,225 @@
 suite: actions template | statefulset
 release:
-  name: gitea-unittests
+  name: gitea-actions-unittests
   namespace: testing
 templates:
   - templates/statefulset.yaml
   - templates/config-act-runner.yaml
 tests:
-  - it: act-runner uses fullOverride
+#
+## GENERIC
+#
+
+  - it: doesn't renders a StatefulSet by default
+    template: templates/statefulset.yaml
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders a StatefulSet (that tracks changes of the runner configuration as annotation)
+    template: templates/statefulset.yaml
+    set:
+      image.tag: "1.22.3" # lock image tag to prevent test failures on future Gitea upgrades
+      enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.metadata.annotations["checksum/config"]
+          value: "368836e4e5d947f06f2d65c7cc3fc3ad050aaced506443f54a8ffc17bb11afd2"
+
+  - it: Has fsGroup in securityContext
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.securityContext:
+        fsGroup: 1000
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.securityContext["fsGroup"]
+          value: 1000
+
+  - it: Has fsGroupChangePolicy in securityContext
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.securityContext:
+        fsGroupChangePolicy: OnRootMismatch
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.securityContext["fsGroupChangePolicy"]
+          value: "OnRootMismatch"
+
+  - it: Has Always in securityContext
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.securityContext:
+        fsGroupChangePolicy: Always
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.securityContext["fsGroupChangePolicy"]
+          value: "Always"
+
+  - it: renders a StatefulSet (with given existingSecret/existingSecretKey)
     template: templates/statefulset.yaml
     set:
       enabled: true
       existingSecret: "my-secret"
       existingSecretKey: "my-secret-key"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].env[0]
+          value:
+            name: GITEA_RUNNER_REGISTRATION_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: "my-secret"
+                key: "my-secret-key"
+
+  - it: renders a StatefulSet http (with correct GITEA_INSTANCE_URL env from giteaRootURL)
+    template: templates/statefulset.yaml
+    set:
+      giteaRootURL: "http://git.example.com"
+      enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].env[1]
+          value:
+            name: GITEA_INSTANCE_URL
+            value: "http://git.example.com"
+      - equal:
+          path: spec.template.spec.initContainers[0].command[2]
+          value: |
+            echo 'Trying to reach Gitea on http://git.example.com'
+            until timeout 10 wget --no-check-certificate --spider http://git.example.com; do
+              sleep 3
+              echo "Trying again in 3 seconds..."
+            done
+            echo "Gitea has been reached!"
+
+  - it: renders a StatefulSet https (with correct GITEA_INSTANCE_URL env from giteaRootURL)
+    template: templates/statefulset.yaml
+    set:
+      giteaRootURL: "https://git.example.com"
+      enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].env[1]
+          value:
+            name: GITEA_INSTANCE_URL
+            value: "https://git.example.com"
+      - equal:
+          path: spec.template.spec.initContainers[0].command[2]
+          value: |
+            echo 'Trying to reach Gitea on https://git.example.com'
+            until timeout 10 wget --no-check-certificate --spider https://git.example.com; do
+              sleep 3
+              echo "Trying again in 3 seconds..."
+            done
+            echo "Gitea has been reached!"
+
+  - it: renders a StatefulSet https with explicit port (with correct GITEA_INSTANCE_URL env from giteaRootURL)
+    template: templates/statefulset.yaml
+    set:
+      giteaRootURL: "https://git.example.com:8443"
+      enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].env[1]
+          value:
+            name: GITEA_INSTANCE_URL
+            value: "https://git.example.com:8443"
+      - equal:
+          path: spec.template.spec.initContainers[0].command[2]
+          value: |
+            echo 'Trying to reach Gitea on https://git.example.com:8443'
+            until timeout 10 wget --no-check-certificate --spider https://git.example.com:8443; do
+              sleep 3
+              echo "Trying again in 3 seconds..."
+            done
+            echo "Gitea has been reached!"
+
+  - it: should render service account name correctly
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset:
+        serviceAccountName: "my-service-account"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: "my-service-account"
+
+  - it: should render runtime class name correctly
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset:
+        runtimeClassName: "my-runtime-class-name"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.template.spec.runtimeClassName
+          value: "my-runtime-class-name"
+
+#
+## ACT_RUNNER
+#
+
+  - it: act-runner uses fullOverride
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
       statefulset.actRunner.fullOverride: test.io/act_runner:x.y.z
     asserts:
       - hasDocuments:
@@ -19,17 +227,16 @@ tests:
       - containsDocument:
           kind: StatefulSet
           apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
+          name: gitea-actions-unittests-act-runner
       - equal:
           path: spec.template.spec.containers[0].image
           value: test.io/act_runner:x.y.z
+
   - it: act-runner uses digest
     template: templates/statefulset.yaml
     set:
       enabled: true
-      existingSecret: "my-secret"
+      statefulset.actRunner.tag: 0.3.1
-      existingSecretKey: "my-secret-key"
-      statefulset.actRunner.tag: 0.2.13
       statefulset.actRunner.digest: sha256:abcdef123456
     asserts:
       - hasDocuments:
@@ -37,104 +244,32 @@ tests:
       - containsDocument:
           kind: StatefulSet
           apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
+          name: gitea-actions-unittests-act-runner
       - equal:
           path: spec.template.spec.containers[0].image
-          value: docker.gitea.com/act_runner:0.2.13@sha256:abcdef123456
+          value: docker.gitea.com/act_runner:0.3.1@sha256:abcdef123456
+
   - it: act-runner uses global.imageRegistry
     template: templates/statefulset.yaml
     set:
       enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
       global.imageRegistry: test.io
-      statefulset.actRunner.tag: 0.2.13
+      statefulset.actRunner.tag: 0.3.1
     asserts:
       - hasDocuments:
           count: 1
       - containsDocument:
           kind: StatefulSet
           apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
+          name: gitea-actions-unittests-act-runner
       - equal:
           path: spec.template.spec.containers[0].image
-          value: test.io/act_runner:0.2.13
+          value: test.io/act_runner:0.3.1
-  - it: dind uses fullOverride
+
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-      statefulset.dind.fullOverride: test.io/dind:x.y.z
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.initContainers[1].image
-          value: test.io/dind:x.y.z
-  - it: dind uses global.imageRegistry
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-      global.imageRegistry: test.io
-      statefulset.dind.tag: 28.3.3-dind
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.initContainers[1].image
-          value: test.io/docker:28.3.3-dind
-  - it: init uses fullOverride
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-      init.image.fullOverride: test.io/busybox:x.y.z
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.initContainers[0].image
-          value: test.io/busybox:x.y.z
-  - it: init uses global.imageRegistry
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-      global.imageRegistry: test.io
-      init.image.tag: 1.37.0
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.initContainers[0].image
-          value: test.io/busybox:1.37.0
   - it: renders additional environment variables for act-runner container in StatefulSet
     template: templates/statefulset.yaml
     set:
       enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
       statefulset:
         actRunner:
           extraEnvs:
@@ -150,7 +285,7 @@ tests:
       - containsDocument:
           kind: StatefulSet
           apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
+          name: gitea-actions-unittests-act-runner
       - equal:
           path: spec.template.spec.containers[0].env[4]
           value:
@@ -162,223 +297,7 @@ tests:
       - matchRegex:
           path: spec.template.spec.containers[0].env[5].name
           pattern: "GITEA_RUNNER_NAME"
-  - it: Has fsGroup in securityContext
+
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-      statefulset.securityContext:
-        fsGroup: 1000
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.securityContext["fsGroup"]
-          value: 1000
-  - it: Has fsGroupChangePolicy in securityContext
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-      statefulset.securityContext:
-        fsGroupChangePolicy: OnRootMismatch
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.securityContext["fsGroupChangePolicy"]
-          value: "OnRootMismatch"
-  - it: Has Always in securityContext
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-      statefulset.securityContext:
-        fsGroupChangePolicy: Always
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.securityContext["fsGroupChangePolicy"]
-          value: "Always"
-  - it: doesn't renders a StatefulSet by default
-    template: templates/statefulset.yaml
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: renders a StatefulSet (with given existingSecret/existingSecretKey)
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.containers[0].env[0]
-          value:
-            name: GITEA_RUNNER_REGISTRATION_TOKEN
-            valueFrom:
-              secretKeyRef:
-                name: "my-secret"
-                key: "my-secret-key"
-  - it: renders a StatefulSet (with secret reference defaults for enabled provisioning)
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      provisioning:
-        enabled: true
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.containers[0].env[0]
-          value:
-            name: GITEA_RUNNER_REGISTRATION_TOKEN
-            valueFrom:
-              secretKeyRef:
-                name: "gitea-unittests-actions-token"
-                key: "token"
-  - it: renders a StatefulSet (that tracks changes of the runner configuration as annotation)
-    template: templates/statefulset.yaml
-    set:
-      image.tag: "1.22.3" # lock image tag to prevent test failures on future Gitea upgrades
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.metadata.annotations["checksum/config"]
-          value: "2bafbf04b3c4293c8ddf895ae3d908e14176ee54a6c724c8cf5b2a1e43c6ece7"
-  - it: renders a StatefulSet http (with correct GITEA_INSTANCE_URL env from giteaRootURL)
-    template: templates/statefulset.yaml
-    set:
-      giteaRootURL: "http://git.example.com"
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.containers[0].env[1]
-          value:
-            name: GITEA_INSTANCE_URL
-            value: "http://git.example.com"
-      - equal:
-          path: spec.template.spec.initContainers[0].command[2]
-          value: |
-            echo 'Trying to reach Gitea on http://git.example.com'
-            until timeout 10 wget --no-check-certificate --spider http://git.example.com; do
-              sleep 3
-              echo "Trying again in 3 seconds..."
-            done
-            echo "Gitea has been reached!"
-  - it: renders a StatefulSet https (with correct GITEA_INSTANCE_URL env from giteaRootURL)
-    template: templates/statefulset.yaml
-    set:
-      giteaRootURL: "https://git.example.com"
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.containers[0].env[1]
-          value:
-            name: GITEA_INSTANCE_URL
-            value: "https://git.example.com"
-      - equal:
-          path: spec.template.spec.initContainers[0].command[2]
-          value: |
-            echo 'Trying to reach Gitea on https://git.example.com'
-            until timeout 10 wget --no-check-certificate --spider https://git.example.com; do
-              sleep 3
-              echo "Trying again in 3 seconds..."
-            done
-            echo "Gitea has been reached!"
-  - it: renders a StatefulSet https (with correct GITEA_INSTANCE_URL env from giteaRootURL)
-    template: templates/statefulset.yaml
-    set:
-      giteaRootURL: "https://git.example.com:8443"
-      enabled: true
-      existingSecret: "my-secret"
-      existingSecretKey: "my-secret-key"
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: StatefulSet
-          apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
-      - equal:
-          path: spec.template.spec.containers[0].env[1]
-          value:
-            name: GITEA_INSTANCE_URL
-            value: "https://git.example.com:8443"
-      - equal:
-          path: spec.template.spec.initContainers[0].command[2]
-          value: |
-            echo 'Trying to reach Gitea on https://git.example.com:8443'
-            until timeout 10 wget --no-check-certificate --spider https://git.example.com:8443; do
-              sleep 3
-              echo "Trying again in 3 seconds..."
-            done
-            echo "Gitea has been reached!"
-  - it: allows adding custom environment variables to the docker-in-docker container
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      statefulset:
-        dind:
-          extraEnvs:
-            - name: "CUSTOM_ENV_NAME"
-              value: "custom env value"
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[1].env[0]
-          value:
-            name: "CUSTOM_ENV_NAME"
-            value: "custom env value"
   - it: should mount an extra volume in the act runner container
     template: templates/statefulset.yaml
     set:
@@ -397,13 +316,67 @@ tests:
       - containsDocument:
           kind: StatefulSet
           apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
+          name: gitea-actions-unittests-act-runner
       - contains:
           any: true
           path: spec.template.spec.containers[0].volumeMounts
           content:
             mountPath: /mnt
             name: my-act-runner-volume
+
+#
+## DIND
+#
+
+  - it: dind uses fullOverride
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.dind.fullOverride: test.io/dind:x.y.z
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.initContainers[1].image
+          value: test.io/dind:x.y.z
+
+  - it: dind uses global.imageRegistry
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      global.imageRegistry: test.io
+      statefulset.dind.tag: 28.3.3-dind
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-actions-unittests-act-runner
+      - equal:
+          path: spec.template.spec.initContainers[1].image
+          value: test.io/docker:28.3.3-dind
+
+  - it: allows adding custom environment variables to the docker-in-docker container
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset:
+        dind:
+          extraEnvs:
+            - name: "CUSTOM_ENV_NAME"
+              value: "custom env value"
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[1].env[0]
+          value:
+            name: "CUSTOM_ENV_NAME"
+            value: "custom env value"
+
   - it: should mount an extra volume in the docker-in-docker container
     template: templates/statefulset.yaml
     set:
@@ -422,81 +395,47 @@ tests:
       - containsDocument:
           kind: StatefulSet
           apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
+          name: gitea-actions-unittests-act-runner
       - contains:
           any: true
           path: spec.template.spec.initContainers[1].volumeMounts
           content:
             mountPath: /mnt
             name: my-dind-volume
-  - it: should interpret existingSecret & existingSecretKey templating
+
+#
+## INIT
+#
+
+  - it: init uses fullOverride
     template: templates/statefulset.yaml
     set:
-      gitea:
-        token:
-          secret:
-            name: "gitea-secret"
-            key: "secret-key"
       enabled: true
-      existingSecret: "{{ .Release.Name }}-{{ .Values.gitea.token.secret.name}}"
+      init.image.fullOverride: test.io/busybox:x.y.z
-      existingSecretKey: "{{ .Values.gitea.token.secret.key}}"
     asserts:
       - hasDocuments:
           count: 1
       - containsDocument:
           kind: StatefulSet
           apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
+          name: gitea-actions-unittests-act-runner
       - equal:
-          path: spec.template.spec.containers[0].env[0].name
+          path: spec.template.spec.initContainers[0].image
-          value: "GITEA_RUNNER_REGISTRATION_TOKEN"
+          value: test.io/busybox:x.y.z
-      - equal:
+
-          path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.name
+  - it: init uses global.imageRegistry
-          value: "gitea-unittests-gitea-secret"
-      - equal:
-          path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.key
-          value: "secret-key"
-  - it: should interpret Gitea Root URL templating
     template: templates/statefulset.yaml
     set:
-      global:
-        gitea:
-          service:
-            name: "my-gitea-svc-http"
-            port: 3210
       enabled: true
-      giteaRootURL: "http://{{ .Values.global.gitea.service.name }}:{{ .Values.global.gitea.service.port }}"
+      global.imageRegistry: test.io
+      init.image.tag: 1.37.0
     asserts:
       - hasDocuments:
           count: 1
       - containsDocument:
           kind: StatefulSet
           apiVersion: apps/v1
-          name: gitea-unittests-actions-act-runner
+          name: gitea-actions-unittests-act-runner
       - equal:
-          path: spec.template.spec.containers[0].env[1].name
+          path: spec.template.spec.initContainers[0].image
-          value: "GITEA_INSTANCE_URL"
+          value: test.io/busybox:1.37.0
-      - equal:
-          path: spec.template.spec.containers[0].env[1].value
-          value: "http://my-gitea-svc-http:3210"
-      - equal:
-          path: spec.template.spec.initContainers[0].command[2]
-          value: |
-            echo 'Trying to reach Gitea on http://my-gitea-svc-http:3210'
-            until timeout 10 wget --no-check-certificate --spider http://my-gitea-svc-http:3210; do
-              sleep 3
-              echo "Trying again in 3 seconds..."
-            done
-            echo "Gitea has been reached!"
-  - it: should render service account name correctly
-    template: templates/statefulset.yaml
-    set:
-      enabled: true
-      statefulset:
-        serviceAccountName: "my-service-account"
-    asserts:
-      - hasDocuments:
-          count: 1
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: "my-service-account"

values.yaml

@@ -26,8 +26,9 @@
 ## @param statefulset.actRunner.pullPolicy The Gitea act runner pullPolicy
 ## @param statefulset.actRunner.fullOverride Completely overrides the image registry, path/image, tag and digest.
 ## @param statefulset.actRunner.extraVolumeMounts Allows mounting extra volumes in the act runner container
-## @param statefulset.actRunner.config [default: Too complex. See values.yaml] Act runner custom configuration. See [Act Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details.
 ## @param statefulset.actRunner.extraEnvs Allows adding custom environment variables
+## @param statefulset.actRunner.flushCache whether to clear the .runner (cache) file by creating an extra init container, can slightly increase boot-up time
+## @param statefulset.actRunner.config [default: Too complex. See values.yaml] Act runner custom configuration. See [Act Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details.
 #
 ## @param statefulset.dind.rootless [default: false] a simple flag to let helm know we are dealing with a rootless dind container
 ## @param statefulset.dind.uid a field to set the running user id for the rootless dind container, so it knows where to look for the socket
@@ -82,6 +83,8 @@ statefulset:
       #     fieldRef:
       #       fieldPath: metadata.name
 
+    # See full details: https://gitea.com/gitea/helm-actions/issues/73
+    flushCache: false
     # See full example here: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
     config: |
       log: