Pin dependencies

github.repository_owner is populated on this Gitea instance: measured as
"jlab-cluster" (12 characters) in run 282 of validate-charts.yml. The
value is now in the comment above the upload step, so the fact survives
without the step that produced it.

.github/workflows/change-app-version.yml

@@ -66,18 +66,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Configure OP-Connect"
-        uses: 1password/load-secrets-action/configure@v5
+        uses: 1password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         with:
           connect-host: https://op-connect.jk-dev.de
       - name: "Load GitHub Credentials"
         id: load-jk-cluster-bot-creds
-        uses: 1password/load-secrets-action@v5
+        uses: 1password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         env:
           OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
           JK_CLUSTER_BOT_TOKEN: op://GitHub-Actions/github-helm-charts-push-token/credential
           JK_CLUSTER_USERNAME: op://GitHub-Actions/github-helm-charts-push-token/username
           JK_CLUSTER_EMAIL: op://GitHub-Actions/github-helm-charts-push-token/email
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ env.JK_CLUSTER_BOT_TOKEN }}
       - name: "Get Chart Version"

.github/workflows/install-test-all-charts.yml

@@ -36,7 +36,7 @@ jobs:
       count: ${{ steps.select.outputs.count }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Select the charts to test"
         id: select
         env:

.github/workflows/install-test.yml

@@ -131,9 +131,9 @@ jobs:
       RUNNER_LABEL: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-docker' }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       - name: "Install kubectl"
         run: |
           # kubectl and the cluster are a pair: the client talks to the server
@@ -205,13 +205,13 @@ jobs:
       # touches the VPN key.
       - name: "Configure OP-Connect"
         if: matrix.chart == 'freesailarr'
-        uses: 1password/load-secrets-action/configure@v5
+        uses: 1password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         with:
           connect-host: https://op-connect.jk-dev.de
       - name: "Load freesailarr VPN credentials"
         id: load-freesailarr-vpn
         if: matrix.chart == 'freesailarr'
-        uses: 1password/load-secrets-action@v5
+        uses: 1password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         env:
           OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
           FREESAILARR_WG_KEY: op://GitHub-Actions/freesailarr-mullvad-test-config/credential

.github/workflows/publish-helm-chart.yml

@@ -36,11 +36,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       - name: "Configure OP-Connect"
-        uses: 1password/load-secrets-action/configure@v5
+        uses: 1password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         with:
           connect-host: https://op-connect.jk-dev.de
       # helm package exits 1 with "found in Chart.yaml, but missing in charts/
@@ -66,7 +66,7 @@ jobs:
         working-directory: ${{ inputs.chart-location }}
       - name: "Load Chart Registry Credentials"
         id: load-registry-creds
-        uses: 1password/load-secrets-action@v5
+        uses: 1password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         env:
           OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
           REGISTRY_PASSWORD: op://GitHub-Actions/jlab-registry-access/password
@@ -74,9 +74,28 @@ jobs:
           REGISTRY_CHARTS_URL: op://GitHub-Actions/jlab-registry-access/charts-url
       # The target is a classic, index-based Helm registry, not an OCI one, so
       # there is no "helm registry login" session and no "helm push": the upload
-      # is a single HTTP POST of the packaged .tgz to <charts-url>/api/charts,
+      # is a single HTTP POST of the packaged .tgz to
-      # authenticated per request. Three properties of this step are load-bearing
+      # <charts-url>/<owner>/helm/api/charts, authenticated per request.
-      # and each of them was paid for once already.
+      #
+      # That URL is composed, not stored (#63). charts-url holds only the base
+      # up to "/api/packages"; the owner segment comes from
+      # github.repository_owner - which Gitea does populate: measured as
+      # "jlab-cluster" in run 282 of validate-charts.yml, on a temporary step
+      # that was removed again. So no value pointing at the registry - not even
+      # a path segment - lives in this repository, and a second owner on the same
+      # instance needs no second setting. The mirror on github.com has Actions
+      # switched off, so the publish never runs there; if it ever did, the
+      # derived owner would be one the instance does not know and the upload
+      # would 404 rather than land somewhere wrong. Two guards make the switch
+      # from the old shape loud instead of puzzling: charts-url is rejected
+      # unless it ends in "/api/packages" (an old full URL still carrying
+      # "/helm", "/api/charts" or the owner is named explicitly), and the derived
+      # owner is rejected when empty or when it holds characters that are not a
+      # path segment - an empty one would build "<base>//helm/api/charts", i.e.
+      # another bare 404 against a masked URL.
+      #
+      # Three further properties of this step are load-bearing and each of them
+      # was paid for once already.
       #
       # 1) The values are mapped into the step's own env block and read as quoted
       # shell variables - never interpolated into the command line. load-secrets-
@@ -114,18 +133,49 @@ jobs:
           REGISTRY_PASSWORD: ${{ steps.load-registry-creds.outputs.REGISTRY_PASSWORD }}
           REGISTRY_USERNAME: ${{ steps.load-registry-creds.outputs.REGISTRY_USERNAME }}
           REGISTRY_CHARTS_URL: ${{ steps.load-registry-creds.outputs.REGISTRY_CHARTS_URL }}
+          REGISTRY_OWNER: ${{ github.repository_owner }}
           CHART_NAME: ${{ inputs.chart-name }}
           CHART_VERSION: ${{ steps.get-chart-version.outputs.CHART_VERSION }}
         run: |-
           : "${REGISTRY_CHARTS_URL:?empty - check op://GitHub-Actions/jlab-registry-access/charts-url}"
           : "${REGISTRY_USERNAME:?empty - check op://GitHub-Actions/jlab-registry-access/username}"
           : "${REGISTRY_PASSWORD:?empty - check op://GitHub-Actions/jlab-registry-access/password}"
+          : "${REGISTRY_OWNER:?empty - github.repository_owner is not populated on this forge; do not hardcode an owner, report it}"
           : "${CHART_NAME:?empty - the chart-name input did not arrive}"
           : "${CHART_VERSION:?empty - could not read version: from ${CHART_NAME}/Chart.yaml}"
           # 1Password masks the full URL, but a curl connection error prints only
           # "<host>:<port>", which that mask would not cover. Mask the host too.
           CHARTS_HOST="${REGISTRY_CHARTS_URL#*://}"
           echo "::add-mask::${CHARTS_HOST%%/*}"
+          # charts-url is the base only; this workflow appends the owner, the
+          # package type and the endpoint. Reject the old, full shape by name so
+          # the failure says what to change in the vault item instead of 404ing
+          # against a URL the log has masked.
+          CHARTS_BASE="${REGISTRY_CHARTS_URL%/}"
+          case "$CHARTS_BASE" in
+            */api/charts)
+              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url still ends in /api/charts - it must hold only the base up to /api/packages (https://<host>/api/packages); this workflow appends /<owner>/helm/api/charts itself"
+              exit 1
+              ;;
+            */helm|*/helm/*)
+              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url still contains the /helm path segment - it must hold only the base up to /api/packages (https://<host>/api/packages); this workflow appends /<owner>/helm/api/charts itself"
+              exit 1
+              ;;
+            */api/packages) ;;
+            *)
+              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url must end in /api/packages (https://<host>/api/packages) - no owner, no package type, no endpoint; this workflow appends /<owner>/helm/api/charts itself"
+              exit 1
+              ;;
+          esac
+          # An empty owner would build "<base>//helm/api/charts", a stray "/" or
+          # "?" would build something else entirely - both are bare 404s.
+          case "$REGISTRY_OWNER" in
+            *[!A-Za-z0-9._-]*)
+              echo "::error::the derived repository owner is not usable as a URL path segment: '${REGISTRY_OWNER}'"
+              exit 1
+              ;;
+          esac
+          CHARTS_API_URL="${CHARTS_BASE}/${REGISTRY_OWNER}/helm/api/charts"
           case "${REGISTRY_USERNAME}${REGISTRY_PASSWORD}" in
             *[[:space:]]*)
               echo "::error::username/password in op://GitHub-Actions/jlab-registry-access must not contain whitespace - curl --config truncates an unquoted value at the first space"
@@ -139,7 +189,7 @@ jobs:
           }
           echo "uploading ${CHART_PACKAGE}"
           printf 'user = %s:%s\nurl = %s\n' \
-            "$REGISTRY_USERNAME" "$REGISTRY_PASSWORD" "${REGISTRY_CHARTS_URL%/}/api/charts" |
+            "$REGISTRY_USERNAME" "$REGISTRY_PASSWORD" "$CHARTS_API_URL" |
             curl --config - \
                  --fail-with-body \
                  --silent --show-error \

.github/workflows/validate-charts.yml

@@ -15,7 +15,7 @@ jobs:
       any-install: ${{ steps.detect.outputs.any-install }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: "Detect changed charts"
@@ -116,11 +116,11 @@ jobs:
         chart: ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       # Both steps below refuse to run while a chart declares a dependency that
       # is not in its charts/ directory - lint with "[WARNING] chart directory
       # is missing these dependencies", package with "found in Chart.yaml, but
@@ -167,9 +167,9 @@ jobs:
     # build-chart, so it adds no wall-clock time to the pipeline.
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       - name: "Render every chart with bare integer quantities"
         run: ci/run-quantity-render-test.sh
 
@@ -197,9 +197,9 @@ jobs:
       TRIVY_CONFIG_MODE: report
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       # A plain release download rather than aquasecurity/setup-trivy, and the
       # reason is measured on the Gitea probe PR of #225, not assumed. That
       # action runs actions/checkout against aquasecurity/trivy on github.com

README.md

@@ -51,7 +51,7 @@ Every chart has a wiki page of its own — `https://git.jk-dev.de/jlab-cluster/h
 ## CI/CD
 
 - `publish-<chart>.yml` — one thin workflow per chart; triggers on pushes to `main` touching `<chart>/**` (or manually) and calls the reusable workflow below. **A push to a chart directory on `main` publishes that chart**, so the chart version must be bumped in the same change.
-- `publish-helm-chart.yml` — reusable workflow: `helm package`, then a single HTTP `POST` of the packaged `.tgz` to the private chart registry. The target is a **classic, index-based** Helm registry (Gitea's `/api/charts` endpoint), not an OCI one: `helm push` speaks only OCI and is not used, there is no `helm registry login` session, and every request carries its own Basic auth. Credentials **and the target URL** come from 1Password Connect (`OP_CONNECT_TOKEN` secret, item `op://GitHub-Actions/jlab-registry-access/` with `username`, `password`, `charts-url`); the workflow appends `/api/charts` to `charts-url`. No registry address ever appears in this repository. The loaded values are read via **`steps.<id>.outputs.*`**, mapped into the step's own `env:` block and used as quoted shell variables — never interpolated into the command line. `load-secrets-action` **v5 no longer exports them as environment variables** for later steps the way v4 did, so after the v5 bump every `${{ env.* }}` reference resolved to an empty string while the loading step still logged `Populating variable` and stayed green. Each value is additionally guarded with `:?`, because an empty one used to collapse into a missing argument rather than an error. Three properties of the upload step are load-bearing:
+- `publish-helm-chart.yml` — reusable workflow: `helm package`, then a single HTTP `POST` of the packaged `.tgz` to the private chart registry. The target is a **classic, index-based** Helm registry (Gitea's `/api/charts` endpoint), not an OCI one: `helm push` speaks only OCI and is not used, there is no `helm registry login` session, and every request carries its own Basic auth. Credentials **and the target URL** come from 1Password Connect (`OP_CONNECT_TOKEN` secret, item `op://GitHub-Actions/jlab-registry-access/` with `username`, `password`, `charts-url`). `charts-url` holds only the **base up to `/api/packages`**; the workflow composes the target as `<charts-url>/<owner>/helm/api/charts`, and the owner comes from **`github.repository_owner`** (#63) — so the 26 thin callers stay as they are and a second owner on the same instance needs no second setting. **No registry address ever appears in this repository**, and since #63 not even the owner path segment: it is derived from the repository rather than stored. Both halves of that composition are guarded, because the only other signal would be a 404 against a URL the log has masked: `charts-url` is rejected unless it ends in `/api/packages` (an old, full URL still carrying `/helm`, `/api/charts` or the owner is named explicitly in the error), and the derived owner is rejected when empty or when it is not a usable path segment — an empty one would build `<base>//helm/api/charts`. The loaded values are read via **`steps.<id>.outputs.*`**, mapped into the step's own `env:` block and used as quoted shell variables — never interpolated into the command line. `load-secrets-action` **v5 no longer exports them as environment variables** for later steps the way v4 did, so after the v5 bump every `${{ env.* }}` reference resolved to an empty string while the loading step still logged `Populating variable` and stayed green. Each value is additionally guarded with `:?`, because an empty one used to collapse into a missing argument rather than an error. Three properties of the upload step are load-bearing:
   - **Credentials stay out of the process list.** `curl --user "$U:$P"` would put them in `argv`; the step uses `curl --config -` and pipes the options in on stdin instead.
   - **A failed upload fails the job.** Unlike `helm push`, `curl` exits **0** on HTTP 401/403/409 — a publish would go green with nothing uploaded. `--fail-with-body` turns those into a non-zero exit and still prints the response body, so the log names the cause.
   - **The file name is built, not globbed.** `<chart>-<version>.tgz` is assembled from the chart name and the version already read from `Chart.yaml`; `--upload-file` takes exactly one file, and a glob matching two silently turns the second into curl's URL argument. `helm package` keeps the `+` of a `1.4.0+up1.9.2` version verbatim in the file name, so the built name is an exact match.

urlaubsverwaltung/Chart.yaml

@@ -4,5 +4,5 @@ description: A Helm chart to deploy urlaubsverwaltung on Kubernetes
 icon: https://raw.githubusercontent.com/urlaubsverwaltung/urlaubsverwaltung/main/src/main/resources/static/favicons/apple-touch-icon.png
 type: application
 
-version: 10.0.1+up6.13.1
+version: 10.0.2+up6.14.0
-appVersion: 6.13.1
+appVersion: 6.14.0