PR #83 - kernelb00t/paperless-ngx-helm

Chart fixes (1.8.1 → 1.8.2)

persistence.*.existingClaim was broken. With it set, the PVC was skipped but the Deployment still mounted <fullname>-<volume>, so the pod stayed Pending. It now mounts the existing claim.
Custom DB secret was broken. cnpg.superuserSecret actually set the application user secret (bootstrap.initdb.secret), and CNPG then doesn't create <cluster>-app. But Paperless always read <cluster>-app. Now:
- the new cnpg.appSecret is used both for initdb and by Paperless;
- superuserSecret is kept as a deprecated alias.
Config/secret changes didn't restart Paperless. Checksum annotations on the Paperless and Redis pods now roll them when paperless.config, paperless.secrets or redis.password change. The checksums are computed from the values, not the rendered manifests, so a chart version bump alone doesn't restart the pods.
cnpg.postgresVersion was unused, even though the README says bumping it triggers the major upgrade. It is now the image tag when cnpg.image.tag is empty, which is the new default. The rendered output is unchanged for default values (postgresql:18).
- ⚠️ Edge case: a release that set postgresVersion to something other than its actual image tag, without setting cnpg.image.tag, will now change images.
Renovate: removed the helmv3 manager and its rules. They never matched anything, because the chart has no Chart.yaml dependencies and helmv3 doesn't read images from values.yaml.

Unit tests (helm-unittest, run in the Lint job): 30 cases in paperless-ngx/tests/, excluded from the package via .helmignore. They cover:
- update strategy;
- volumes and existingClaim;
- DB secret selection;
- checksums;
- CNPG image, plugins and initdb secret;
- PVCs, Redis, and secret validation.
Checked that they fail against the previous templates.
Integration tests now run as a matrix:
- install: fresh install.
- upgrade: install the latest published chart from GHCR, create a tag through the API, helm upgrade to this chart, then check the tag survived.
- An Integration Test aggregator job keeps the existing check name.
Smoke test moved to .github/scripts/smoke-test.sh. It uses a port-forward with retries plus an authenticated API call, instead of kubectl run -i, which could lose the curl output (the flake seen on #82).

helm lint, helm unittest (30/30)
Rendered output unchanged for default values apart from the chart label and the new checksum annotations
shellcheck on the scripts, workflow validated against the GitHub Actions schema

🤖 Generated with Claude Code

Generated by Claude Code

Fixes chart configuration bugs, makes cnpg.postgresVersion effective, and adds safer rollout and CI coverage.

persistence.*.existingClaim now mounts the configured PVC instead of the chart-managed name.
New cnpg.appSecret configures and reads the application database credentials; superuserSecret remains a deprecated alias.
Paperless and Redis pods roll when chart-managed config or secrets change; externally managed secrets still require a manual restart.
cnpg.postgresVersion supplies the image tag when cnpg.image.tag is empty, so affected releases may change images on upgrade.
Generated checksum keys cannot be overridden through podAnnotations, and null podAnnotations are tolerated.
Removed the unused Renovate helmv3 manager and rules.

Tests

Added 30 helm-unittest cases for strategies, volumes, claims, database secrets, checksums, CNPG images, PVCs, Redis, and secret validation.
CI now tests fresh installs and upgrades from the latest published chart, including data persistence.
Smoke tests use authenticated API calls through a resilient port-forward with retries and timeouts.
Readiness checks fail explicitly when the CNPG cluster does not appear, and the integration gate distinguishes skipped path-filter runs from failed jobs.