merge upstream

chore(deps): update lockfiles (#67 )
This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.com/gitea/helm-actions/pulls/67 Reviewed-by: DaanSelen <daanselen@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com> Co-committed-by: Renovate Bot <renovate-bot@gitea.com>
2025-09-28 01:58:59 +00:00 · 2025-09-25 08:45:22 +00:00 · 2025-09-24 18:52:27 +00:00 · 2025-09-22 12:11:26 +00:00 · 2025-09-22 06:43:25 +00:00 · 2025-09-21 19:30:21 +00:00
17 changed files with 556 additions and 175 deletions
--- a/.gitea/workflows/changelog.yml
+++ b/.gitea/workflows/changelog.yml
@@ -8,12 +8,12 @@ on:
 jobs:
  changelog:
    runs-on: ubuntu-latest
-    container: docker.io/thegeeklab/git-sv:1.0.12
+    container: docker.io/thegeeklab/git-sv:2.0.5
    steps:
      - name: install tools
        run: |
          apk add -q --update --no-cache nodejs curl jq sed
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Generate upcoming changelog
--- a/.gitea/workflows/commitlint.yml
+++ b/.gitea/workflows/commitlint.yml
@@ -11,9 +11,9 @@ on:
 jobs:
  check-and-test:
    runs-on: ubuntu-latest
-    container: commitlint/commitlint:19.7.1
+    container: commitlint/commitlint:19.9.1
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - name: check PR title
        run: |
          echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json
--- a/.gitea/workflows/release-version.yml
+++ b/.gitea/workflows/release-version.yml
@@ -7,13 +7,13 @@ on:

 env:
  # renovate: datasource=docker depName=alpine/helm
-  HELM_VERSION: "3.17.1"
+  HELM_VERSION: "3.19.0"

 jobs:
  generate-chart-publish:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - name: install tools
        run: |
          apt update -y
@@ -59,7 +59,7 @@ jobs:
          helm registry logout registry-1.docker.io

      - name: aws credential configure
-        uses: https://github.com/aws-actions/configure-aws-credentials@v4
+        uses: https://github.com/aws-actions/configure-aws-credentials@v5
        with:
          aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
--- a/.gitea/workflows/shellcheck.yml
+++ b/.gitea/workflows/shellcheck.yml
@@ -9,6 +9,6 @@ jobs:
  shellcheck:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v5
      - run: apt update --yes && apt install --yes shellcheck
      - run: find . -type f -name "*.sh" -exec shellcheck -a {} \;
--- a/.gitea/workflows/test-pr.yml
+++ b/.gitea/workflows/test-pr.yml
@@ -10,12 +10,12 @@ on:

 env:
  # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
-  HELM_UNITTEST_VERSION: "v0.7.2"
+  HELM_UNITTEST_VERSION: "v1.0.1"

 jobs:
  check-and-test:
    runs-on: ubuntu-latest
-    container: alpine/helm:3.17.1
+    container: alpine/helm:3.19.0
    steps:
      - name: install tools
        run: |
@@ -25,7 +25,7 @@ jobs:
        uses: pnpm/action-setup@v4
        with:
          version: 10
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - name: install chart dependencies
        run: helm dependency build
      - name: lint
--- a/README.md
+++ b/README.md
@@ -6,12 +6,39 @@ The parameters which can be used to customize the deployment are described below

 If you want to propose a new feature or mechanism, submit an [issue here](https://gitea.com/gitea/helm-actions/issues).

+## Docs
+
+[Docs](./docs/README.md)
+
 ## Rootless Defaults

 If `.Values.image.rootless: true`, then the following will occur. In case you use `.Values.image.fullOverride`, check that this works in your image:

 - If `.Values.provisioning.enabled: true`, then uses the rootless Gitea image, must match helm-Gitea.

+## Quick-start
+
+To get started, add the Helm repo, assuming you have not already:
+
+```sh
+helm repo add gitea-charts https://dl.gitea.com/charts/
+helm repo update
+```
+
+Then pull the values.yaml file and fill it accordingly.
+
+```sh
+helm show values gitea-charts/actions > values.yaml
+```
+
+Deploy with your values, make sure the path is correct:
+
+```sh
+helm upgrade --install gitea-actions gitea-charts/actions -f values.yaml
+```
+
+You should be good to go!
+
 ## Parameters

 ### Gitea Actions
@@ -22,6 +49,7 @@ If `.Values.image.rootless: true`, then the following will occur. In case you us
 | `init.image.repository`                   | The image used for the init containers                                                                                                      | `busybox`                      |
 | `init.image.tag`                          | The image tag used for the init containers                                                                                                  | `1.37.0`                       |
 | `statefulset.replicas`                    | the amount of (replica) runner pods deployed                                                                                                | `1`                            |
+| `statefulset.timezone`                    | is the timezone that will be set in the act_runner image                                                                                    | `Etc/UTC`                      |
 | `statefulset.annotations`                 | Act runner annotations                                                                                                                      | `{}`                           |
 | `statefulset.labels`                      | Act runner labels                                                                                                                           | `{}`                           |
 | `statefulset.resources`                   | Act runner resources                                                                                                                        | `{}`                           |
@@ -29,13 +57,20 @@ If `.Values.image.rootless: true`, then the following will occur. In case you us
 | `statefulset.tolerations`                 | Tolerations for the statefulset                                                                                                             | `[]`                           |
 | `statefulset.affinity`                    | Affinity for the statefulset                                                                                                                | `{}`                           |
 | `statefulset.extraVolumes`                | Extra volumes for the statefulset                                                                                                           | `[]`                           |
-| `statefulset.actRunner.repository`        | The Gitea act runner image                                                                                                                  | `gitea/act_runner`             |
-| `statefulset.actRunner.tag`               | The Gitea act runner tag                                                                                                                    | `0.2.11`                       |
+| `statefulset.actRunner.registry`          | image registry, e.g. gcr.io,docker.io                                                                                                       | `docker.gitea.com`             |
+| `statefulset.actRunner.repository`        | The Gitea act runner image                                                                                                                  | `act_runner`                   |
+| `statefulset.actRunner.tag`               | The Gitea act runner tag                                                                                                                    | `0.2.13`                       |
+| `statefulset.actRunner.digest`            | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`                                  | `""`                           |
 | `statefulset.actRunner.pullPolicy`        | The Gitea act runner pullPolicy                                                                                                             | `IfNotPresent`                 |
+| `statefulset.actRunner.fullOverride`      | Completely overrides the image registry, path/image, tag and digest.                                                                        | `""`                           |
 | `statefulset.actRunner.extraVolumeMounts` | Allows mounting extra volumes in the act runner container                                                                                   | `[]`                           |
 | `statefulset.actRunner.config`            | Act runner custom configuration. See [Act Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details. | `Too complex. See values.yaml` |
+| `statefulset.dind.registry`               | image registry, e.g. gcr.io,docker.io                                                                                                       | `""`                           |
+| `statefulset.actRunner.extraEnvs`         | Allows adding custom environment variables                                                                                                  | `[]`                           |
 | `statefulset.dind.repository`             | The Docker-in-Docker image                                                                                                                  | `docker`                       |
-| `statefulset.dind.tag`                    | The Docker-in-Docker image tag                                                                                                              | `25.0.2-dind`                  |
+| `statefulset.dind.tag`                    | The Docker-in-Docker image tag                                                                                                              | `28.3.3-dind`                  |
+| `statefulset.dind.digest`                 | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`                                  | `""`                           |
+| `statefulset.dind.fullOverride`           | Completely overrides the image registry, path/image, tag and digest.                                                                        | `""`                           |
 | `statefulset.dind.pullPolicy`             | The Docker-in-Docker pullPolicy                                                                                                             | `IfNotPresent`                 |
 | `statefulset.dind.extraVolumeMounts`      | Allows mounting extra volumes in the Docker-in-Docker container                                                                             | `[]`                           |
 | `statefulset.dind.extraEnvs`              | Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`                                                                | `[]`                           |
@@ -44,6 +79,17 @@ If `.Values.image.rootless: true`, then the following will occur. In case you us
 | `existingSecretKey`                       | Secret key                                                                                                                                  | `""`                           |
 | `giteaRootURL`                            | URL the act_runner registers and connect with                                                                                               | `""`                           |

+### Gitea Actions Init
+
+| Name                      | Description                                                                                                | Value          |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------- | -------------- |
+| `init.image.registry`     | image registry, e.g. gcr.io,docker.io                                                                      | `""`           |
+| `init.image.repository`   | The init image                                                                                             | `busybox`      |
+| `init.image.tag`          | the init image tag                                                                                         | `1.37.0`       |
+| `init.image.digest`       | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""`           |
+| `init.image.pullPolicy`   | The init image pullPolicy                                                                                  | `IfNotPresent` |
+| `init.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest.                                       | `""`           |
+
 ### Global

 | Name                   | Description                    | Value |
--- a/docs/README.md
+++ b/docs/README.md
@@ -0,0 +1,3 @@
+# Gitea Actions Helm Chart Docs
+
+- [Share dind with job container](share-dind-with-job-container.md)
--- a/docs/share-dind-with-job-container.md
+++ b/docs/share-dind-with-job-container.md
@@ -0,0 +1,36 @@
+# Share dind with job container
+
+You can weaken isolation and allow jobs to call docker commands.
+
+## Limitations
+
+- Docker bind mounts like `-v /path/on/self/container:/path/to/new/container` do not work, because they are going to mount the path from the dind container
+- Docker port expose to local host `-e 80:8080` is not going to work
+
+## Example Values
+
+```yaml
+enabled: true
+statefulset:
+  actRunner:
+    # See full example here: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
+    config: |
+      log:
+        level: debug
+      cache:
+        enabled: false
+      container:
+        valid_volumes:
+        - /var/run/docker.sock
+        options: -v /var/run/docker.sock:/var/run/docker.sock
+
+## Specify an existing token secret
+##
+existingSecret: "runner-token2"
+existingSecretKey: "token"
+
+## Specify the root URL of the Gitea instance
+giteaRootURL: "http://192.168.1.2:3000"
+```
+
+Now you can run docker commands inside your jobs.
--- a/package.json
+++ b/package.json
@@ -14,6 +14,6 @@
  },
  "devDependencies": {
    "@bitnami/readme-generator-for-helm": "^2.7.0",
-    "markdownlint-cli": "^0.44.0"
+    "markdownlint-cli": "^0.45.0"
  }
 }
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -10,25 +10,29 @@ importers:
    devDependencies:
      '@bitnami/readme-generator-for-helm':
        specifier: ^2.7.0
-        version: 2.7.0
+        version: 2.7.2
      markdownlint-cli:
-        specifier: ^0.44.0
-        version: 0.44.0
+        specifier: ^0.45.0
+        version: 0.45.0

 packages:

-  '@bitnami/readme-generator-for-helm@2.7.0':
-    resolution: {integrity: sha512-fVxExmcuJ9NZb9ZE9OW3+lG8pUlXJAJdaO8UukV3A7WzYu4qOTr03MXPH9Gt5e/6mo3x4WYI/cXBksKfS0qn3w==}
+  '@bitnami/readme-generator-for-helm@2.7.2':
+    resolution: {integrity: sha512-7eXyJzxQTQj2ajpHlIhadciCCYWOqN8ieaweU25bStHOZowQ2c2CQyjO/bX4gxIf73LoRKxHhEYgLTllJY9SIw==}
    hasBin: true

+  '@isaacs/balanced-match@4.0.1':
+    resolution: {integrity: sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==}
+    engines: {node: 20 || >=22}
+
+  '@isaacs/brace-expansion@5.0.0':
+    resolution: {integrity: sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==}
+    engines: {node: 20 || >=22}
+
  '@isaacs/cliui@8.0.2':
    resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
    engines: {node: '>=12'}

-  '@pkgjs/parseargs@0.11.0':
-    resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
-    engines: {node: '>=14'}
-
  '@types/debug@4.1.12':
    resolution: {integrity: sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==}

@@ -45,16 +49,16 @@ packages:
    resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
    engines: {node: '>=8'}

-  ansi-regex@6.1.0:
-    resolution: {integrity: sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA==}
+  ansi-regex@6.2.2:
+    resolution: {integrity: sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==}
    engines: {node: '>=12'}

  ansi-styles@4.3.0:
    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
    engines: {node: '>=8'}

-  ansi-styles@6.2.1:
-    resolution: {integrity: sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==}
+  ansi-styles@6.2.3:
+    resolution: {integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==}
    engines: {node: '>=12'}

  argparse@2.0.1:
@@ -63,11 +67,8 @@ packages:
  balanced-match@1.0.2:
    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}

-  brace-expansion@1.1.11:
-    resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==}
-
-  brace-expansion@2.0.1:
-    resolution: {integrity: sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==}
+  brace-expansion@1.1.12:
+    resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==}

  character-entities-legacy@3.0.0:
    resolution: {integrity: sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==}
@@ -104,8 +105,8 @@ packages:
    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
    engines: {node: '>= 8'}

-  debug@4.4.0:
-    resolution: {integrity: sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==}
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
    engines: {node: '>=6.0'}
    peerDependencies:
      supports-color: '*'
@@ -113,8 +114,8 @@ packages:
      supports-color:
        optional: true

-  decode-named-character-reference@1.1.0:
-    resolution: {integrity: sha512-Wy+JTSbFThEOXQIR2L6mxJvEs+veIzpmqD7ynWxMXGpnk3smkHQOp6forLdHsKpAMW9iJpaBBIxz285t1n1C3w==}
+  decode-named-character-reference@1.2.0:
+    resolution: {integrity: sha512-c6fcElNV6ShtZXmsgNgFFV5tVX2PaV4g+MOAkb8eXHvn6sryJBrZa9r0zV6+dtTyoCKxtDy5tyQ5ZwQuidtd+Q==}

  deep-extend@0.6.0:
    resolution: {integrity: sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==}
@@ -151,16 +152,17 @@ packages:
  fs.realpath@1.0.0:
    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}

-  glob@10.4.5:
-    resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
+  glob@11.0.3:
+    resolution: {integrity: sha512-2Nim7dha1KVkaiF4q6Dj+ngPPMdfvLJEOpZk/jKiUAkqKebpGAWQXAq9z1xu9HKu5lWfqw/FASuccEjyznjPaA==}
+    engines: {node: 20 || >=22}
    hasBin: true

  glob@7.2.3:
    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
    deprecated: Glob versions prior to v9 are no longer supported

-  ignore@7.0.3:
-    resolution: {integrity: sha512-bAH5jbK/F3T3Jls4I0SO1hmPR0dKU0a7+SY6n1yzRtG54FLO8d6w/nxLFX2Nb7dBu6cCWXPaAME6cYqFUMmuCA==}
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
    engines: {node: '>= 4'}

  inflight@1.0.6:
@@ -193,8 +195,9 @@ packages:
  isexe@2.0.0:
    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}

-  jackspeak@3.4.3:
-    resolution: {integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==}
+  jackspeak@4.1.1:
+    resolution: {integrity: sha512-zptv57P3GpL+O0I7VdMJNBZCu+BPHVQUk55Ft8/QCJjTVxrnJHuVuX/0Bl2A6/+2oyR/ZMEuFKwmzqqZ/U5nPQ==}
+    engines: {node: 20 || >=22}

  js-yaml@4.1.0:
    resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==}
@@ -207,8 +210,8 @@ packages:
    resolution: {integrity: sha512-p/nXbhSEcu3pZRdkW1OfJhpsVtW1gd4Wa1fnQc9YLiTfAjn0312eMKimbdIQzuZl9aa9xUGaRlP9T/CJE/ditQ==}
    engines: {node: '>=0.10.0'}

-  katex@0.16.21:
-    resolution: {integrity: sha512-XvqR7FgOHtWupfMiigNzmh+MgUVmDGU2kXZm899ZkPfcuoPuFxyHmXsgATDpFZDAXCI8tvinaVcDo8PIIJSo4A==}
+  katex@0.16.22:
+    resolution: {integrity: sha512-XCHRdUw4lf3SKBaJe4EvgqIuWwkPSo9XoeO8GjQW94Bp7TWv9hNhzZjZ+OH9yf1UmLygb7DIT5GSFQiyt16zYg==}
    hasBin: true

  linkify-it@5.0.0:
@@ -217,8 +220,9 @@ packages:
  lodash@4.17.21:
    resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}

-  lru-cache@10.4.3:
-    resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
+  lru-cache@11.2.2:
+    resolution: {integrity: sha512-F9ODfyqML2coTIsQpSkRHnLSZMtkU8Q+mSfcaIyKwy58u+8k5nvAYeiNhsyMARvzNcXJ9QfWVrcPsC9e9rAxtg==}
+    engines: {node: 20 || >=22}

  markdown-it@14.1.0:
    resolution: {integrity: sha512-a54IwgWPaeBCAAsv13YgmALOF1elABB08FxO9i+r4VFk5Vl4pKokRPeX8u5TCgSsPi6ec1otfLjdOpVcgbpshg==}
@@ -227,23 +231,23 @@ packages:
  markdown-table@2.0.0:
    resolution: {integrity: sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A==}

-  markdownlint-cli@0.44.0:
-    resolution: {integrity: sha512-ZJTAONlvF9NkrIBltCdW15DxN9UTbPiKMEqAh2EU2gwIFlrCMavyCEPPO121cqfYOrLUJWW8/XKWongstmmTeQ==}
-    engines: {node: '>=18'}
+  markdownlint-cli@0.45.0:
+    resolution: {integrity: sha512-GiWr7GfJLVfcopL3t3pLumXCYs8sgWppjIA1F/Cc3zIMgD3tmkpyZ1xkm1Tej8mw53B93JsDjgA3KOftuYcfOw==}
+    engines: {node: '>=20'}
    hasBin: true

-  markdownlint@0.37.4:
-    resolution: {integrity: sha512-u00joA/syf3VhWh6/ybVFkib5Zpj2e5KB/cfCei8fkSRuums6nyisTWGqjTWIOFoFwuXoTBQQiqlB4qFKp8ncQ==}
-    engines: {node: '>=18'}
+  markdownlint@0.38.0:
+    resolution: {integrity: sha512-xaSxkaU7wY/0852zGApM8LdlIfGCW8ETZ0Rr62IQtAnUMlMuifsg09vWJcNYeL4f0anvr8Vo4ZQar8jGpV0btQ==}
+    engines: {node: '>=20'}

  mdurl@2.0.0:
    resolution: {integrity: sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==}

-  micromark-core-commonmark@2.0.2:
-    resolution: {integrity: sha512-FKjQKbxd1cibWMM1P9N+H8TwlgGgSkWZMmfuVucLCHaYqeSvJ0hFeHsIa65pA2nYbes0f8LDHPMrd9X7Ujxg9w==}
+  micromark-core-commonmark@2.0.3:
+    resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==}

-  micromark-extension-directive@3.0.2:
-    resolution: {integrity: sha512-wjcXHgk+PPdmvR58Le9d7zQYWy+vKEU9Se44p2CrCDPiLr2FMyiT4Fyb5UFKFC66wGB3kPlgD7q3TnoqPS7SZA==}
+  micromark-extension-directive@4.0.0:
+    resolution: {integrity: sha512-/C2nqVmXXmiseSSuCdItCMho7ybwwop6RrrRPk0KbOHW21JKoCldC+8rFOaundDoRBUWBnJJcxeA/Kvi34WQXg==}

  micromark-extension-gfm-autolink-literal@2.1.0:
    resolution: {integrity: sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw==}
@@ -251,8 +255,8 @@ packages:
  micromark-extension-gfm-footnote@2.1.0:
    resolution: {integrity: sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw==}

-  micromark-extension-gfm-table@2.1.0:
-    resolution: {integrity: sha512-Ub2ncQv+fwD70/l4ou27b4YzfNaCJOvyX4HxXU15m7mpYY+rjuWzsLIPZHJL253Z643RpbcP1oeIJlQ/SKW67g==}
+  micromark-extension-gfm-table@2.1.1:
+    resolution: {integrity: sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg==}

  micromark-extension-math@3.1.0:
    resolution: {integrity: sha512-lvEqd+fHjATVs+2v/8kg9i5Q0AP2k85H0WUOwpIVvUML8BapsMvh1XAogmQjOCsLpoKRCVQqEkQBB3NhVBcsOg==}
@@ -308,19 +312,19 @@ packages:
  micromark-util-symbol@2.0.1:
    resolution: {integrity: sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==}

-  micromark-util-types@2.0.1:
-    resolution: {integrity: sha512-534m2WhVTddrcKVepwmVEVnUAmtrx9bfIjNoQHRqfnvdaHQiFytEhJoTgpWJvDEXCO5gLTQh3wYC1PgOJA4NSQ==}
+  micromark-util-types@2.0.2:
+    resolution: {integrity: sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==}

-  micromark@4.0.1:
-    resolution: {integrity: sha512-eBPdkcoCNvYcxQOAKAlceo5SNdzZWfF+FcSupREAzdAh9rRmE239CEQAiTwIgblwnoM8zzj35sZ5ZwvSEOF6Kw==}
+  micromark@4.0.2:
+    resolution: {integrity: sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA==}
+
+  minimatch@10.0.3:
+    resolution: {integrity: sha512-IPZ167aShDZZUMdRk66cyQAW3qr0WzbHkPdMYa8bzZhlHhO3jALbKdxcaak7W9FfT2rZNpQuUu4Od7ILEpXSaw==}
+    engines: {node: 20 || >=22}

  minimatch@3.1.2:
    resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}

-  minimatch@9.0.5:
-    resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==}
-    engines: {node: '>=16 || 14 >=14.17'}
-
  minimist@1.2.8:
    resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}

@@ -348,9 +352,9 @@ packages:
    resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
    engines: {node: '>=8'}

-  path-scurry@1.11.1:
-    resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
-    engines: {node: '>=16 || 14 >=14.18'}
+  path-scurry@2.0.0:
+    resolution: {integrity: sha512-ypGJsmGtdXUOeM5u93TyeIEfEhM6s+ljAhrk5vAvSx8uyY/02OvrZnA0YNGUrPXfpJMgI1ODd3nwz8Npx4O4cg==}
+    engines: {node: 20 || >=22}

  punycode.js@2.3.1:
    resolution: {integrity: sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==}
@@ -376,8 +380,8 @@ packages:
    resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
    engines: {node: '>=14'}

-  smol-toml@1.3.1:
-    resolution: {integrity: sha512-tEYNll18pPKHroYSmLLrksq233j021G0giwW7P3D24jC54pQ5W5BXMsQ/Mvw1OJCmEYDgY+lrzT+3nNUtoNfXQ==}
+  smol-toml@1.3.4:
+    resolution: {integrity: sha512-UOPtVuYkzYGee0Bd2Szz8d2G3RfMfJ2t3qVdZUAozZyAk+a0Sxa+QKix0YCwjL/A1RR0ar44nCxaoN9FxdJGwA==}
    engines: {node: '>= 18'}

  string-width@4.2.3:
@@ -392,8 +396,8 @@ packages:
    resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
    engines: {node: '>=8'}

-  strip-ansi@7.1.0:
-    resolution: {integrity: sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==}
+  strip-ansi@7.1.2:
+    resolution: {integrity: sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==}
    engines: {node: '>=12'}

  strip-json-comments@3.1.1:
@@ -419,33 +423,36 @@ packages:
  wrappy@1.0.2:
    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}

-  yaml@2.7.0:
-    resolution: {integrity: sha512-+hSoy/QHluxmC9kCIJyL/uyFmLmc+e5CFR5Wa+bpIhIj85LVb9ZH2nVnqrHoSvKogwODv0ClqZkmiSSaIH5LTA==}
-    engines: {node: '>= 14'}
+  yaml@2.8.1:
+    resolution: {integrity: sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==}
+    engines: {node: '>= 14.6'}
    hasBin: true

 snapshots:

-  '@bitnami/readme-generator-for-helm@2.7.0':
+  '@bitnami/readme-generator-for-helm@2.7.2':
    dependencies:
      commander: 13.1.0
      dot-object: 2.1.5
      lodash: 4.17.21
      markdown-table: 2.0.0
-      yaml: 2.7.0
+      yaml: 2.8.1
+
+  '@isaacs/balanced-match@4.0.1': {}
+
+  '@isaacs/brace-expansion@5.0.0':
+    dependencies:
+      '@isaacs/balanced-match': 4.0.1

  '@isaacs/cliui@8.0.2':
    dependencies:
      string-width: 5.1.2
      string-width-cjs: string-width@4.2.3
-      strip-ansi: 7.1.0
+      strip-ansi: 7.1.2
      strip-ansi-cjs: strip-ansi@6.0.1
      wrap-ansi: 8.1.0
      wrap-ansi-cjs: wrap-ansi@7.0.0

-  '@pkgjs/parseargs@0.11.0':
-    optional: true
-
  '@types/debug@4.1.12':
    dependencies:
      '@types/ms': 2.1.0
@@ -458,27 +465,23 @@ snapshots:

  ansi-regex@5.0.1: {}

-  ansi-regex@6.1.0: {}
+  ansi-regex@6.2.2: {}

  ansi-styles@4.3.0:
    dependencies:
      color-convert: 2.0.1

-  ansi-styles@6.2.1: {}
+  ansi-styles@6.2.3: {}

  argparse@2.0.1: {}

  balanced-match@1.0.2: {}

-  brace-expansion@1.1.11:
+  brace-expansion@1.1.12:
    dependencies:
      balanced-match: 1.0.2
      concat-map: 0.0.1

-  brace-expansion@2.0.1:
-    dependencies:
-      balanced-match: 1.0.2
-
  character-entities-legacy@3.0.0: {}

  character-entities@2.0.2: {}
@@ -505,11 +508,11 @@ snapshots:
      shebang-command: 2.0.0
      which: 2.0.2

-  debug@4.4.0:
+  debug@4.4.3:
    dependencies:
      ms: 2.1.3

-  decode-named-character-reference@1.1.0:
+  decode-named-character-reference@1.2.0:
    dependencies:
      character-entities: 2.0.2

@@ -541,14 +544,14 @@ snapshots:

  fs.realpath@1.0.0: {}

-  glob@10.4.5:
+  glob@11.0.3:
    dependencies:
      foreground-child: 3.3.1
-      jackspeak: 3.4.3
-      minimatch: 9.0.5
+      jackspeak: 4.1.1
+      minimatch: 10.0.3
      minipass: 7.1.2
      package-json-from-dist: 1.0.1
-      path-scurry: 1.11.1
+      path-scurry: 2.0.0

  glob@7.2.3:
    dependencies:
@@ -559,7 +562,7 @@ snapshots:
      once: 1.4.0
      path-is-absolute: 1.0.1

-  ignore@7.0.3: {}
+  ignore@7.0.5: {}

  inflight@1.0.6:
    dependencies:
@@ -585,11 +588,9 @@ snapshots:

  isexe@2.0.0: {}

-  jackspeak@3.4.3:
+  jackspeak@4.1.1:
    dependencies:
      '@isaacs/cliui': 8.0.2
-    optionalDependencies:
-      '@pkgjs/parseargs': 0.11.0

  js-yaml@4.1.0:
    dependencies:
@@ -599,7 +600,7 @@ snapshots:

  jsonpointer@5.0.1: {}

-  katex@0.16.21:
+  katex@0.16.22:
    dependencies:
      commander: 8.3.0

@@ -609,7 +610,7 @@ snapshots:

  lodash@4.17.21: {}

-  lru-cache@10.4.3: {}
+  lru-cache@11.2.2: {}

  markdown-it@14.1.0:
    dependencies:
@@ -624,40 +625,40 @@ snapshots:
    dependencies:
      repeat-string: 1.6.1

-  markdownlint-cli@0.44.0:
+  markdownlint-cli@0.45.0:
    dependencies:
      commander: 13.1.0
-      glob: 10.4.5
-      ignore: 7.0.3
+      glob: 11.0.3
+      ignore: 7.0.5
      js-yaml: 4.1.0
      jsonc-parser: 3.3.1
      jsonpointer: 5.0.1
-      markdownlint: 0.37.4
-      minimatch: 9.0.5
+      markdown-it: 14.1.0
+      markdownlint: 0.38.0
+      minimatch: 10.0.3
      run-con: 1.3.2
-      smol-toml: 1.3.1
+      smol-toml: 1.3.4
    transitivePeerDependencies:
      - supports-color

-  markdownlint@0.37.4:
+  markdownlint@0.38.0:
    dependencies:
-      markdown-it: 14.1.0
-      micromark: 4.0.1
-      micromark-core-commonmark: 2.0.2
-      micromark-extension-directive: 3.0.2
+      micromark: 4.0.2
+      micromark-core-commonmark: 2.0.3
+      micromark-extension-directive: 4.0.0
      micromark-extension-gfm-autolink-literal: 2.1.0
      micromark-extension-gfm-footnote: 2.1.0
-      micromark-extension-gfm-table: 2.1.0
+      micromark-extension-gfm-table: 2.1.1
      micromark-extension-math: 3.1.0
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2
    transitivePeerDependencies:
      - supports-color

  mdurl@2.0.0: {}

-  micromark-core-commonmark@2.0.2:
+  micromark-core-commonmark@2.0.3:
    dependencies:
-      decode-named-character-reference: 1.1.0
+      decode-named-character-reference: 1.2.0
      devlop: 1.1.0
      micromark-factory-destination: 2.0.1
      micromark-factory-label: 2.0.1
@@ -672,16 +673,16 @@ snapshots:
      micromark-util-resolve-all: 2.0.1
      micromark-util-subtokenize: 2.1.0
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

-  micromark-extension-directive@3.0.2:
+  micromark-extension-directive@4.0.0:
    dependencies:
      devlop: 1.1.0
      micromark-factory-space: 2.0.1
      micromark-factory-whitespace: 2.0.1
      micromark-util-character: 2.1.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2
      parse-entities: 4.0.2

  micromark-extension-gfm-autolink-literal@2.1.0:
@@ -689,73 +690,73 @@ snapshots:
      micromark-util-character: 2.1.1
      micromark-util-sanitize-uri: 2.0.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-extension-gfm-footnote@2.1.0:
    dependencies:
      devlop: 1.1.0
-      micromark-core-commonmark: 2.0.2
+      micromark-core-commonmark: 2.0.3
      micromark-factory-space: 2.0.1
      micromark-util-character: 2.1.1
      micromark-util-normalize-identifier: 2.0.1
      micromark-util-sanitize-uri: 2.0.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

-  micromark-extension-gfm-table@2.1.0:
+  micromark-extension-gfm-table@2.1.1:
    dependencies:
      devlop: 1.1.0
      micromark-factory-space: 2.0.1
      micromark-util-character: 2.1.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-extension-math@3.1.0:
    dependencies:
      '@types/katex': 0.16.7
      devlop: 1.1.0
-      katex: 0.16.21
+      katex: 0.16.22
      micromark-factory-space: 2.0.1
      micromark-util-character: 2.1.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-factory-destination@2.0.1:
    dependencies:
      micromark-util-character: 2.1.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-factory-label@2.0.1:
    dependencies:
      devlop: 1.1.0
      micromark-util-character: 2.1.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-factory-space@2.0.1:
    dependencies:
      micromark-util-character: 2.1.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-factory-title@2.0.1:
    dependencies:
      micromark-factory-space: 2.0.1
      micromark-util-character: 2.1.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-factory-whitespace@2.0.1:
    dependencies:
      micromark-factory-space: 2.0.1
      micromark-util-character: 2.1.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-util-character@2.1.1:
    dependencies:
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-util-chunked@2.0.1:
    dependencies:
@@ -765,12 +766,12 @@ snapshots:
    dependencies:
      micromark-util-character: 2.1.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-util-combine-extensions@2.0.1:
    dependencies:
      micromark-util-chunked: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-util-decode-numeric-character-reference@2.0.2:
    dependencies:
@@ -786,7 +787,7 @@ snapshots:

  micromark-util-resolve-all@2.0.1:
    dependencies:
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-util-sanitize-uri@2.0.1:
    dependencies:
@@ -799,19 +800,19 @@ snapshots:
      devlop: 1.1.0
      micromark-util-chunked: 2.0.1
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2

  micromark-util-symbol@2.0.1: {}

-  micromark-util-types@2.0.1: {}
+  micromark-util-types@2.0.2: {}

-  micromark@4.0.1:
+  micromark@4.0.2:
    dependencies:
      '@types/debug': 4.1.12
-      debug: 4.4.0
-      decode-named-character-reference: 1.1.0
+      debug: 4.4.3
+      decode-named-character-reference: 1.2.0
      devlop: 1.1.0
-      micromark-core-commonmark: 2.0.2
+      micromark-core-commonmark: 2.0.3
      micromark-factory-space: 2.0.1
      micromark-util-character: 2.1.1
      micromark-util-chunked: 2.0.1
@@ -823,17 +824,17 @@ snapshots:
      micromark-util-sanitize-uri: 2.0.1
      micromark-util-subtokenize: 2.1.0
      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2
    transitivePeerDependencies:
      - supports-color

+  minimatch@10.0.3:
+    dependencies:
+      '@isaacs/brace-expansion': 5.0.0
+
  minimatch@3.1.2:
    dependencies:
-      brace-expansion: 1.1.11
-
-  minimatch@9.0.5:
-    dependencies:
-      brace-expansion: 2.0.1
+      brace-expansion: 1.1.12

  minimist@1.2.8: {}

@@ -852,7 +853,7 @@ snapshots:
      '@types/unist': 2.0.11
      character-entities-legacy: 3.0.0
      character-reference-invalid: 2.0.1
-      decode-named-character-reference: 1.1.0
+      decode-named-character-reference: 1.2.0
      is-alphanumerical: 2.0.1
      is-decimal: 2.0.1
      is-hexadecimal: 2.0.1
@@ -861,9 +862,9 @@ snapshots:

  path-key@3.1.1: {}

-  path-scurry@1.11.1:
+  path-scurry@2.0.0:
    dependencies:
-      lru-cache: 10.4.3
+      lru-cache: 11.2.2
      minipass: 7.1.2

  punycode.js@2.3.1: {}
@@ -885,7 +886,7 @@ snapshots:

  signal-exit@4.1.0: {}

-  smol-toml@1.3.1: {}
+  smol-toml@1.3.4: {}

  string-width@4.2.3:
    dependencies:
@@ -897,15 +898,15 @@ snapshots:
    dependencies:
      eastasianwidth: 0.2.0
      emoji-regex: 9.2.2
-      strip-ansi: 7.1.0
+      strip-ansi: 7.1.2

  strip-ansi@6.0.1:
    dependencies:
      ansi-regex: 5.0.1

-  strip-ansi@7.1.0:
+  strip-ansi@7.1.2:
    dependencies:
-      ansi-regex: 6.1.0
+      ansi-regex: 6.2.2

  strip-json-comments@3.1.1: {}

@@ -923,10 +924,10 @@ snapshots:

  wrap-ansi@8.1.0:
    dependencies:
-      ansi-styles: 6.2.1
+      ansi-styles: 6.2.3
      string-width: 5.1.2
-      strip-ansi: 7.1.0
+      strip-ansi: 7.1.2

  wrappy@1.0.2: {}

-  yaml@2.7.0: {}
+  yaml@2.8.1: {}
--- a/renovate.json5
+++ b/renovate.json5
@@ -9,19 +9,19 @@
  labels: [
    'kind/dependency',
  ],
-  "digest": {
-    "automerge": true
+  digest: {
+    automerge: true,
  },
  automergeStrategy: 'squash',
  'git-submodules': {
-    'enabled': true
+    enabled: true,
  },
  customManagers: [
    {
      description: 'Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions',
      customType: 'regex',
-      fileMatch: [
-        '.gitea/workflows/.+\\.ya?ml$',
+      managerFilePatterns: [
+        '/.gitea/workflows/.+\\.ya?ml$/',
      ],
      matchStrings: [
        '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
@@ -30,13 +30,23 @@
    {
      description: 'Detect helm-unittest yaml schema file',
      customType: 'regex',
-      fileMatch: ['.vscode/settings\\.json$'],
+      managerFilePatterns: [
+        '/.vscode/settings\\.json$/',
+      ],
      matchStrings: [
        'https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json',
      ],
      datasourceTemplate: 'github-releases',
    },
  ],
+  lockFileMaintenance: {
+    "enabled": true,
+    "commitMessageAction": "update",
+    "commitMessageTopic": "lockfiles",
+    schedule: [
+      'at any time',
+    ]
+  },
  packageRules: [
    {
      groupName: 'subcharts (minor & patch)',
@@ -49,6 +59,17 @@
        'digest',
      ],
    },
+    {
+      groupName: 'bats testing framework',
+      matchManagers: [
+        'git-submodules',
+      ],
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+        'digest',
+      ],
+    },
    {
      groupName: 'workflow dependencies (minor & patch)',
      matchManagers: [
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -86,3 +86,46 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- define "gitea.actions.local_root_url" -}}
  {{- .Values.giteaRootURL -}}
 {{- end -}}
+
+{{/*
+Common create image implementation
+*/}}
+{{- define "gitea.actions.common.image" -}}
+{{- $fullOverride := .image.fullOverride | default "" -}}
+{{- $registry := .root.Values.global.imageRegistry | default .image.registry -}}
+{{- $repository :=  .image.repository -}}
+{{- $separator := ":" -}}
+{{- $tag := .image.tag | default .root.Chart.AppVersion | toString -}}
+{{- $digest := "" -}}
+{{- if .image.digest }}
+    {{- $digest = (printf "@%s" (.image.digest | toString)) -}}
+{{- end -}}
+{{- if $fullOverride }}
+    {{- printf "%s" $fullOverride -}}
+{{- else if $registry }}
+    {{- printf "%s/%s%s%s%s" $registry $repository $separator $tag $digest -}}
+{{- else -}}
+    {{- printf "%s%s%s%s" $repository $separator $tag $digest -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create image for the Gitea Actions Act Runner
+*/}}
+{{- define "gitea.actions.actRunner.image" -}}
+{{ include "gitea.actions.common.image" (dict "root" . "image" .Values.statefulset.actRunner) }}
+{{- end -}}
+
+{{/*
+Create image for DinD
+*/}}
+{{- define "gitea.actions.dind.image" -}}
+{{ include "gitea.actions.common.image" (dict "root" . "image" .Values.statefulset.dind) }}
+{{- end -}}
+
+{{/*
+Create image for Init
+*/}}
+{{- define "gitea.actions.init.image" -}}
+{{ include "gitea.actions.common.image" (dict "root" . "image" .Values.init.image) }}
+{{- end -}}
--- a/templates/config-act-runner.yaml
+++ b/templates/config-act-runner.yaml
@@ -10,6 +10,10 @@ metadata:
 data:
  config.yaml: |
    {{- with .Values.statefulset.actRunner.config -}}
+    {{- if kindIs "string" . -}}
    {{ . | nindent 4}}
+    {{- else -}}
+    {{ toYaml . | nindent 4}}
+    {{- end -}}
    {{- end -}}
 {{- end }}
--- a/templates/statefulset.yaml
+++ b/templates/statefulset.yaml
@@ -32,7 +32,7 @@ spec:
    spec:
      initContainers:
        - name: init-gitea
-          image: "{{ .Values.init.image.repository }}:{{ .Values.init.image.tag }}"
+          image: "{{ include "gitea.actions.init.image" . }}"
          command:
            - sh
            - -c
@@ -45,7 +45,7 @@ spec:
              echo "Gitea has been reached!"
      containers:
        - name: act-runner
-          image: "{{ .Values.statefulset.actRunner.repository }}:{{ .Values.statefulset.actRunner.tag }}"
+          image: "{{ include "gitea.actions.actRunner.image" . }}"
          imagePullPolicy: {{ .Values.statefulset.actRunner.pullPolicy }}
          workingDir: /data
          env:
@@ -54,7 +54,7 @@ spec:
            - name: DOCKER_TLS_VERIFY
              value: "1"
            - name: DOCKER_CERT_PATH
-              value: /certs/server
+              value: /certs/client
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
@@ -64,13 +64,18 @@ spec:
              value: {{ include "gitea.actions.local_root_url" . }}
            - name: CONFIG_FILE
              value: /actrunner/config.yaml
+            - name: TZ
+              value: {{ .Values.statefulset.timezone | default "Etc/UTC" }}
+            {{- if .Values.statefulset.actRunner.extraEnvs }}
+            {{- toYaml .Values.statefulset.actRunner.extraEnvs | nindent 12 }}
+            {{- end }}
          resources:
            {{- toYaml .Values.statefulset.resources | nindent 12 }}
          volumeMounts:
            - mountPath: /actrunner/config.yaml
              name: act-runner-config
              subPath: config.yaml
-            - mountPath: /certs/server
+            - mountPath: /certs/client
              name: docker-certs
            - mountPath: /data
              name: data-act-runner
@@ -78,7 +83,7 @@ spec:
            {{- toYaml . | nindent 12 }}
            {{- end }}
        - name: dind
-          image: "{{ .Values.statefulset.dind.repository }}:{{ .Values.statefulset.dind.tag }}"
+          image: "{{ include "gitea.actions.dind.image" . }}"
          imagePullPolicy: {{ .Values.statefulset.dind.pullPolicy }}
          env:
            - name: DOCKER_HOST
@@ -86,7 +91,7 @@ spec:
            - name: DOCKER_TLS_VERIFY
              value: "1"
            - name: DOCKER_CERT_PATH
-              value: /certs/server
+              value: /certs/client
            {{- if .Values.statefulset.dind.extraEnvs }}
            {{- toYaml .Values.statefulset.dind.extraEnvs | nindent 12 }}
            {{- end }}
@@ -95,7 +100,7 @@ spec:
          resources:
            {{- toYaml .Values.statefulset.resources | nindent 12 }}
          volumeMounts:
-            - mountPath: /certs/server
+            - mountPath: /certs/client
              name: docker-certs
            {{- with .Values.statefulset.dind.extraVolumeMounts }}
            {{- toYaml . | nindent 12 }}
@@ -112,6 +117,10 @@ spec:
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if .Values.statefulset.dnsConfig }}
+      dnsConfig:
+        {{- toYaml .Values.statefulset.dnsConfig | nindent 8 }}
+      {{- end }}
      volumes:
        - name: act-runner-config
          configMap:
--- a/unittests/helm/config-act-runner.yaml
+++ b/unittests/helm/config-act-runner.yaml
@@ -42,3 +42,27 @@ tests:
            runner:
              labels:
                - "ubuntu-latest"
+  - it: renders a ConfigMap with inline yaml
+    template: templates/config-act-runner.yaml
+    set:
+      enabled: true
+      statefulset:
+        actRunner:
+          config:
+            container:
+              valid_volumes:
+                - /var/run/docker.sock
+              options: -v /var/run/docker.sock:/var/run/docker.sock
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: ConfigMap
+          apiVersion: v1
+          name: gitea-unittests-actions-act-runner-config
+      - matchRegex:
+          path: data["config.yaml"]
+          pattern: '(?m)^\s*options:\s*-v /var/run/docker.sock:/var/run/docker.sock\s*$'
+      - matchRegex:
+          path: data["config.yaml"]
+          pattern: '(?m)^\s*valid_volumes:\s*\n\s*-\s*/var/run/docker.sock\s*$'
--- a/unittests/helm/statefulset.yaml
+++ b/unittests/helm/statefulset.yaml
@@ -6,6 +6,162 @@ templates:
  - templates/statefulset.yaml
  - templates/config-act-runner.yaml
 tests:
+  - it: act-runner uses fullOverride
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      existingSecret: "my-secret"
+      existingSecretKey: "my-secret-key"
+      statefulset.actRunner.fullOverride: test.io/act_runner:x.y.z
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: test.io/act_runner:x.y.z
+  - it: act-runner uses digest
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      existingSecret: "my-secret"
+      existingSecretKey: "my-secret-key"
+      statefulset.actRunner.tag: 0.2.13
+      statefulset.actRunner.digest: sha256:abcdef123456
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: docker.gitea.com/act_runner:0.2.13@sha256:abcdef123456
+  - it: act-runner uses global.imageRegistry
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      existingSecret: "my-secret"
+      existingSecretKey: "my-secret-key"
+      global.imageRegistry: test.io
+      statefulset.actRunner.tag: 0.2.13
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: test.io/act_runner:0.2.13
+  - it: dind uses fullOverride
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      existingSecret: "my-secret"
+      existingSecretKey: "my-secret-key"
+      statefulset.dind.fullOverride: test.io/dind:x.y.z
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.containers[1].image
+          value: test.io/dind:x.y.z
+  - it: dind uses global.imageRegistry
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      existingSecret: "my-secret"
+      existingSecretKey: "my-secret-key"
+      global.imageRegistry: test.io
+      statefulset.dind.tag: 28.3.3-dind
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.containers[1].image
+          value: test.io/docker:28.3.3-dind
+  - it: init uses fullOverride
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      existingSecret: "my-secret"
+      existingSecretKey: "my-secret-key"
+      init.image.fullOverride: test.io/busybox:x.y.z
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.initContainers[0].image
+          value: test.io/busybox:x.y.z
+  - it: init uses global.imageRegistry
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      existingSecret: "my-secret"
+      existingSecretKey: "my-secret-key"
+      global.imageRegistry: test.io
+      init.image.tag: 1.37.0
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.initContainers[0].image
+          value: test.io/busybox:1.37.0
+  - it: renders additional environment variables for act-runner container in StatefulSet
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      existingSecret: "my-secret"
+      existingSecretKey: "my-secret-key"
+      statefulset:
+        actRunner:
+          extraEnvs:
+            - name: "CUSTOM_ENV"
+              value: "1"
+            - name: "GITEA_RUNNER_NAME"
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet
+          apiVersion: apps/v1
+          name: gitea-unittests-actions-act-runner
+      - equal:
+          path: spec.template.spec.containers[0].env[7]
+          value:
+            name: CUSTOM_ENV
+            value: "1"
+      - matchRegex:
+          path: spec.template.spec.containers[0].env[8].valueFrom.fieldRef.fieldPath
+          pattern: "metadata\\.name"
+      - matchRegex:
+          path: spec.template.spec.containers[0].env[8].name
+          pattern: "GITEA_RUNNER_NAME"
  - it: doesn't renders a StatefulSet by default
    template: templates/statefulset.yaml
    asserts:
@@ -69,7 +225,7 @@ tests:
          name: gitea-unittests-actions-act-runner
      - equal:
          path: spec.template.metadata.annotations["checksum/config"]
-          value: "7566d9c60261bf8cbff6a6936fc7aead96cec540d8c793d142a5ad4664c56ba5"
+          value: "2bafbf04b3c4293c8ddf895ae3d908e14176ee54a6c724c8cf5b2a1e43c6ece7"
  - it: renders a StatefulSet http (with correct GITEA_INSTANCE_URL env from giteaRootURL)
    template: templates/statefulset.yaml
    set:
--- a/values.yaml
+++ b/values.yaml
@@ -5,20 +5,29 @@
 ## @param init.image.repository The image used for the init containers
 ## @param init.image.tag The image tag used for the init containers
 ## @param statefulset.replicas the amount of (replica) runner pods deployed
+## @param statefulset.timezone is the timezone that will be set in the act_runner image
 ## @param statefulset.annotations Act runner annotations
 ## @param statefulset.labels Act runner labels
 ## @param statefulset.resources Act runner resources
 ## @param statefulset.nodeSelector NodeSelector for the statefulset
 ## @param statefulset.tolerations Tolerations for the statefulset
+## @param statefulset.dnsConfig dnsConfig for the statefulset
 ## @param statefulset.affinity Affinity for the statefulset
 ## @param statefulset.extraVolumes Extra volumes for the statefulset
+## @param statefulset.actRunner.registry image registry, e.g. gcr.io,docker.io
 ## @param statefulset.actRunner.repository The Gitea act runner image
 ## @param statefulset.actRunner.tag The Gitea act runner tag
+## @param statefulset.actRunner.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
 ## @param statefulset.actRunner.pullPolicy The Gitea act runner pullPolicy
+## @param statefulset.actRunner.fullOverride Completely overrides the image registry, path/image, tag and digest.
 ## @param statefulset.actRunner.extraVolumeMounts Allows mounting extra volumes in the act runner container
 ## @param statefulset.actRunner.config [default: Too complex. See values.yaml] Act runner custom configuration. See [Act Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details.
+## @param statefulset.dind.registry image registry, e.g. gcr.io,docker.io
+## @param statefulset.actRunner.extraEnvs Allows adding custom environment variables
 ## @param statefulset.dind.repository The Docker-in-Docker image
 ## @param statefulset.dind.tag The Docker-in-Docker image tag
+## @param statefulset.dind.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
+## @param statefulset.dind.fullOverride Completely overrides the image registry, path/image, tag and digest.
 ## @param statefulset.dind.pullPolicy The Docker-in-Docker pullPolicy
 ## @param statefulset.dind.extraVolumeMounts Allows mounting extra volumes in the Docker-in-Docker container
 ## @param statefulset.dind.extraEnvs Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`
@@ -29,19 +38,30 @@
 enabled: false
 statefulset:
  replicas: 1
+  timezone: Etc/UTC
  annotations: {}
  labels: {}
  resources: {}
  nodeSelector: {}
  tolerations: []
+  dnsConfig: {}
  affinity: {}
  extraVolumes: []

  actRunner:
-    repository: gitea/act_runner
-    tag: 0.2.11
+    registry: "docker.gitea.com"
+    repository: act_runner
+    tag: 0.2.13
+    digest: ""
    pullPolicy: IfNotPresent
+    fullOverride: ""
    extraVolumeMounts: []
+    extraEnvs:
+      []
+      # - name: "GITEA_RUNNER_NAME"
+      #   valueFrom:
+      #     fieldRef:
+      #       fieldPath: metadata.name

    # See full example here: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
    config: |
@@ -49,11 +69,17 @@ statefulset:
        level: debug
      cache:
        enabled: false
+      container:
+        require_docker: true
+        docker_timeout: 300s

  dind:
+    registry: ""
    repository: docker
-    tag: 25.0.2-dind
+    tag: 28.3.3-dind
+    digest: ""
    pullPolicy: IfNotPresent
+    fullOverride: ""
    extraVolumeMounts: []

    # If the container keeps crashing in your environment, you might have to add the `DOCKER_IPTABLES_LEGACY` environment variable.
@@ -66,11 +92,23 @@ statefulset:
  persistence:
    size: 1Gi

+## @section Gitea Actions Init
+#
+## @param init.image.registry image registry, e.g. gcr.io,docker.io
+## @param init.image.repository The init image
+## @param init.image.tag the init image tag
+## @param init.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
+## @param init.image.pullPolicy The init image pullPolicy
+## @param init.image.fullOverride Completely overrides the image registry, path/image, tag and digest.
 init:
  image:
+    registry: ""
    repository: busybox
    # Overrides the image tag whose default is the chart appVersion.
    tag: "1.37.0"
+    digest: ""
+    pullPolicy: IfNotPresent
+    fullOverride: ""

 ## Specify an existing token secret
 ##