chore(deps): update lockfiles

This a correction that is forf from original work of [anders.eficode](https://gitea.com/anders.eficode) on [pull request #160](https://gitea.com/gitea/helm-actions/pulls/160)
Description of the change
Adds statefulset.dind.resources and statefulset.runner.resources as optional per-container resource overrides. When set, each takes precedence over the shared statefulset.resources for that container. When unset (default {}), statefulset.resources is used as before.

Benefits
The DinD sidecar and the runner container have very different resource profiles — DinD is memory-hungry (image layer cache, concurrent builds, image pulls) while the runner is a lightweight coordinator that is mostly idle between jobs. Separate resource limits allow right-sizing each container independently, avoiding the choice between over-provisioning the runner or under-provisioning DinD.

Possible drawbacks
None. Fully backward-compatible — both new values default to {}, causing the shared statefulset.resources fallback to apply exactly as before.

Checklist
- [x] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm)
- [x] Breaking changes are documented in the `README.md`
- [x] Helm templating unittests are added (required when changing anything in `templates` folder)
- [x] Bash unittests are added (required when changing anything in `scripts` folder)
- [x] All added template resources MUST render a namespace in metadata

---------

Co-authored-by: Le Prévost-Corvellec Arnault <arnault.le.prevost.corvellec@carbon-it.com>
Co-authored-by: Anders <lantzanders@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-actions/pulls/168
Reviewed-by: DaanSelen <135789+daanselen@noreply.gitea.com>
Co-authored-by: Arnault_LPC <194310+arnault_lpc@noreply.gitea.com>

.gitea/workflows/commitlint.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   check-and-test:
     runs-on: ubuntu-latest
-    container: commitlint/commitlint:21.2.0
+    container: commitlint/commitlint:21.2.1
     steps:
       - uses: actions/checkout@v7
       - name: check PR title

.gitea/workflows/release-version.yml

@@ -7,7 +7,7 @@ on:
 
 env:
   # renovate: datasource=docker depName=alpine/helm
-  HELM_VERSION: "4.2.2"
+  HELM_VERSION: "4.2.3"
 
 jobs:
   generate-chart-publish:

.gitea/workflows/test-pr.yml

@@ -16,7 +16,7 @@ env:
 jobs:
   check-and-test:
     runs-on: ubuntu-latest
-    container: alpine/helm:4.2.2
+    container: alpine/helm:4.2.3
     steps:
       - name: install tools
         run: |

README.md

@@ -65,45 +65,49 @@ If `.Values.statefulset.dind.rootless: true` is set, then the following will be
 
 ### Gitea Actions
 
-| Name                                   | Description                                                                                                                                     | Value                          |
+For resource limit examples (runner vs DinD), see [docs/resources.md](./docs/resources.md).
-| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
+
-| `enabled`                              | Create a Gitea Runner StatefulSet.                                                                                                              | `false`                        |
+| Name                                   | Description                                                                                                                                            | Value                          |
-| `statefulset.replicas`                 | the amount of (replica) runner pods deployed                                                                                                    | `1`                            |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
-| `statefulset.timezone`                 | is the timezone that will be set in the runner image                                                                                            | `Etc/UTC`                      |
+| `enabled`                              | Create a Gitea Runner StatefulSet.                                                                                                                     | `false`                        |
-| `statefulset.annotations`              | Gitea Runner annotations                                                                                                                        | `{}`                           |
+| `statefulset.replicas`                 | the amount of (replica) runner pods deployed                                                                                                           | `1`                            |
-| `statefulset.labels`                   | Gitea Runner labels                                                                                                                             | `{}`                           |
+| `statefulset.timezone`                 | is the timezone that will be set in the runner image                                                                                                   | `Etc/UTC`                      |
-| `statefulset.resources`                | Gitea Runner resources                                                                                                                          | `{}`                           |
+| `statefulset.annotations`              | Gitea Runner annotations                                                                                                                               | `{}`                           |
-| `statefulset.nodeSelector`             | NodeSelector for the statefulset                                                                                                                | `{}`                           |
+| `statefulset.labels`                   | Gitea Runner labels                                                                                                                                    | `{}`                           |
-| `statefulset.tolerations`              | Tolerations for the statefulset                                                                                                                 | `[]`                           |
+| `statefulset.resources`                | Shared resource requests/limits for both containers. Overridden by statefulset.runner.resources and statefulset.dind.resources. See docs/resources.md. | `{}`                           |
-| `statefulset.affinity`                 | Affinity for the statefulset                                                                                                                    | `{}`                           |
+| `statefulset.nodeSelector`             | NodeSelector for the statefulset                                                                                                                       | `{}`                           |
-| `statefulset.extraVolumes`             | Extra volumes for the statefulset                                                                                                               | `[]`                           |
+| `statefulset.tolerations`              | Tolerations for the statefulset                                                                                                                        | `[]`                           |
-| `statefulset.persistence.size`         | Size for persistence to store Gitea Runner data                                                                                                 | `1Gi`                          |
+| `statefulset.affinity`                 | Affinity for the statefulset                                                                                                                           | `{}`                           |
-| `statefulset.securityContext`          | Customize the SecurityContext                                                                                                                   | `{}`                           |
+| `statefulset.extraVolumes`             | Extra volumes for the statefulset                                                                                                                      | `[]`                           |
-| `statefulset.serviceAccountName`       | Customize the service account name                                                                                                              | `""`                           |
+| `statefulset.persistence.size`         | Size for persistence to store Gitea Runner data                                                                                                        | `1Gi`                          |
-| `statefulset.runtimeClassName`         | Select a different RuntimeClass for pods                                                                                                        | `""`                           |
+| `statefulset.securityContext`          | Customize the SecurityContext                                                                                                                          | `{}`                           |
-| `statefulset.hostAliases`              | Inject entries into the /etc/hosts file                                                                                                         | `[]`                           |
+| `statefulset.serviceAccountName`       | Customize the service account name                                                                                                                     | `""`                           |
-| `statefulset.persistence.size`         | Size for persistence to store Gitea Runner data                                                                                                 | `1Gi`                          |
+| `statefulset.runtimeClassName`         | Select a different RuntimeClass for pods                                                                                                               | `""`                           |
-| `statefulset.runner.registry`          | image registry, e.g. gcr.io,docker.io                                                                                                           | `docker.gitea.com`             |
+| `statefulset.hostAliases`              | Inject entries into the /etc/hosts file                                                                                                                | `[]`                           |
-| `statefulset.runner.repository`        | The Gitea Runner image                                                                                                                          | `runner`                       |
+| `statefulset.persistence.size`         | Size for persistence to store Gitea Runner data                                                                                                        | `1Gi`                          |
-| `statefulset.runner.tag`               | The Gitea Runner tag                                                                                                                            | `2.0.1`                        |
+| `statefulset.runner.registry`          | image registry, e.g. gcr.io,docker.io                                                                                                                  | `docker.gitea.com`             |
-| `statefulset.runner.digest`            | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`                                      | `""`                           |
+| `statefulset.runner.repository`        | The Gitea Runner image                                                                                                                                 | `runner`                       |
-| `statefulset.runner.pullPolicy`        | The Gitea Runner pullPolicy                                                                                                                     | `IfNotPresent`                 |
+| `statefulset.runner.tag`               | The Gitea Runner tag                                                                                                                                   | `2.0.1`                        |
-| `statefulset.runner.fullOverride`      | Completely overrides the image registry, path/image, tag and digest.                                                                            | `""`                           |
+| `statefulset.runner.digest`            | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`                                             | `""`                           |
-| `statefulset.runner.extraVolumeMounts` | Allows mounting extra volumes in the Gitea Runner container                                                                                     | `[]`                           |
+| `statefulset.runner.pullPolicy`        | The Gitea Runner pullPolicy                                                                                                                            | `IfNotPresent`                 |
-| `statefulset.runner.extraEnvs`         | Allows adding custom environment variables                                                                                                      | `[]`                           |
+| `statefulset.runner.fullOverride`      | Completely overrides the image registry, path/image, tag and digest.                                                                                   | `""`                           |
-| `statefulset.runner.flushCache`        | whether to clear the .runner (cache) file by creating an extra init container, can slightly increase boot-up time                               | `false`                        |
+| `statefulset.runner.resources`         | Resource requests/limits for the runner container. Takes precedence over statefulset.resources when set.                                               | `{}`                           |
-| `statefulset.runner.config`            | Gitea Runner custom configuration. See [Gitea Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details. | `Too complex. See values.yaml` |
+| `statefulset.runner.extraVolumeMounts` | Allows mounting extra volumes in the Gitea Runner container                                                                                            | `[]`                           |
-| `statefulset.dind.rootless`            | a simple flag to let helm know we are dealing with a rootless dind container                                                                    | `false`                        |
+| `statefulset.runner.extraEnvs`         | Allows adding custom environment variables                                                                                                             | `[]`                           |
-| `statefulset.dind.uid`                 | a field to set the running user id for the rootless dind container, so it knows where to look for the socket                                    | `""`                           |
+| `statefulset.runner.flushCache`        | whether to clear the .runner (cache) file by creating an extra init container, can slightly increase boot-up time                                      | `false`                        |
-| `statefulset.dind.registry`            | image registry, e.g. gcr.io,docker.io                                                                                                           | `docker.io`                    |
+| `statefulset.runner.config`            | Gitea Runner custom configuration. See [Gitea Runner documentation](https://docs.gitea.com/usage/actions/act-runner#configuration) for details.        | `Too complex. See values.yaml` |
-| `statefulset.dind.repository`          | The Docker-in-Docker image                                                                                                                      | `docker`                       |
+| `statefulset.dind.rootless`            | a simple flag to let helm know we are dealing with a rootless dind container                                                                           | `false`                        |
-| `statefulset.dind.tag`                 | The Docker-in-Docker image tag                                                                                                                  | `29.5.2-dind`                  |
+| `statefulset.dind.uid`                 | a field to set the running user id for the rootless dind container, so it knows where to look for the socket                                           | `""`                           |
-| `statefulset.dind.digest`              | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`                                      | `""`                           |
+| `statefulset.dind.registry`            | image registry, e.g. gcr.io,docker.io                                                                                                                  | `docker.io`                    |
-| `statefulset.dind.fullOverride`        | Completely overrides the image registry, path/image, tag and digest.                                                                            | `""`                           |
+| `statefulset.dind.repository`          | The Docker-in-Docker image                                                                                                                             | `docker`                       |
-| `statefulset.dind.pullPolicy`          | The Docker-in-Docker pullPolicy                                                                                                                 | `IfNotPresent`                 |
+| `statefulset.dind.tag`                 | The Docker-in-Docker image tag                                                                                                                         | `29.5.2-dind`                  |
-| `statefulset.dind.extraVolumeMounts`   | Allows mounting extra volumes in the Docker-in-Docker container                                                                                 | `[]`                           |
+| `statefulset.dind.digest`              | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`                                             | `""`                           |
-| `statefulset.dind.extraEnvs`           | Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`                                                                    | `[]`                           |
+| `statefulset.dind.fullOverride`        | Completely overrides the image registry, path/image, tag and digest.                                                                                   | `""`                           |
-| `statefulset.dind.extraArgs`           | Allows adding custom arguments to the Docker Daemon                                                                                             | `[]`                           |
+| `statefulset.dind.pullPolicy`          | The Docker-in-Docker pullPolicy                                                                                                                        | `IfNotPresent`                 |
+| `statefulset.dind.resources`           | Resource requests/limits for the DinD sidecar container. Takes precedence over statefulset.resources when set.                                         | `{}`                           |
+| `statefulset.dind.extraVolumeMounts`   | Allows mounting extra volumes in the Docker-in-Docker container                                                                                        | `[]`                           |
+| `statefulset.dind.extraEnvs`           | Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`                                                                           | `[]`                           |
+| `statefulset.dind.extraArgs`           | Allows adding custom arguments to the Docker Daemon                                                                                                    | `[]`                           |
 
 ### Gitea Actions Init
 

docs/README.md

@@ -1,3 +1,4 @@
 # Gitea Actions Helm Chart Docs
 
+- [Resource limits and capacity](./resources.md)
 - [connectionCommandOverride explanation](./connectionCommandOverride.md)

docs/resources.md

@@ -0,0 +1,173 @@
+# Resource limits and capacity
+
+By default, all resource values are empty (`{}`). Without explicit limits, runner pods can consume unbounded CPU and memory on a node. This guide explains how to configure resource usage properly.
+
+## Pod architecture
+
+Each runner pod contains two resource-consuming containers:
+
+| Container | Role | Helm value |
+| --- | --- | --- |
+| `runner` | Polls Gitea and orchestrates CI jobs | `statefulset.runner.resources` |
+| `dind` | Docker-in-Docker daemon; executes job containers | `statefulset.dind.resources` |
+
+The DinD container runs as a native sidecar (`initContainer` with `restartPolicy: Always`).
+
+## Helm resource keys
+
+Three values control Kubernetes resource requests and limits:
+
+| Key | Purpose |
+| --- | --- |
+| `statefulset.resources` | Shared fallback applied to **both** containers when no override is set |
+| `statefulset.runner.resources` | Override for the `runner` container only |
+| `statefulset.dind.resources` | Override for the `dind` container only |
+
+Precedence:
+
+```text
+statefulset.runner.resources  →  else statefulset.resources
+statefulset.dind.resources    →  else statefulset.resources
+```
+
+**Recommendation:** set `statefulset.runner.resources` and `statefulset.dind.resources`
+explicitly instead of relying on the shared fallback. The runner process is lightweight;
+DinD and CI workloads need most of the budget.
+
+## Example: separate runner and DinD limits
+
+```yaml
+enabled: true
+giteaRootURL: https://gitea.example.com
+existingSecret: runner-secret
+existingSecretKey: runner-token
+
+statefulset:
+  replicas: 1
+
+  runner:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
+    config: |
+      log:
+        level: info
+      cache:
+        enabled: false
+      runner:
+        capacity: 1
+      container:
+        require_docker: true
+        docker_timeout: 300s
+
+  dind:
+    resources:
+      requests:
+        cpu: 500m
+        memory: 2Gi
+      limits:
+        cpu: 2
+        memory: 4Gi
+```
+
+## Two layers of limiting
+
+Kubernetes limits and act-runner job limits serve different purposes. Use both for a robust setup.
+
+### 1. Kubernetes limits (Helm values)
+
+These apply to the `runner` and `dind` containers in the pod.
+
+- **`dind` limits** cap the Docker daemon and everything it runs inside the pod (images, build caches, job containers).
+- **`runner` limits** cap the act-runner process itself.
+
+If neither is set, a runaway build can exhaust the entire node.
+
+### 2. Per-job Docker limits (`container.options`)
+
+CI jobs run as Docker containers spawned by act-runner through the Docker socket. They are
+**not** separate Kubernetes containers. Configure per-job limits in `statefulset.runner.config`
+— see [act-runner configuration](https://docs.gitea.com/usage/actions/act-runner#configuration)
+and [config.example.yaml](https://gitea.com/gitea/runner/src/branch/main/internal/pkg/config/config.example.yaml).
+
+## act-runner settings that affect resource usage
+
+Settings such as `runner.capacity` and `container.options` live in `statefulset.runner.config`, not in the Helm resource values. Refer to the runner documentation for details:
+
+- [act-runner configuration](https://docs.gitea.com/usage/actions/act-runner#configuration)
+- [config.example.yaml](https://gitea.com/gitea/runner/src/branch/main/internal/pkg/config/config.example.yaml) in the [Gitea/runner](https://gitea.com/gitea/runner) repository
+
+When concurrent jobs or per-job Docker limits increase expected load, size `statefulset.dind.resources` accordingly on the Helm side.
+
+## Capacity planning
+
+These formulas apply to the Helm resource values (`statefulset.runner.resources`, `statefulset.dind.resources`, `statefulset.replicas`):
+
+### Per pod
+
+```text
+pod budget ≈ runner.limits + dind.limits
+```
+
+### Per node
+
+```text
+node budget ≈ (runner.limits + dind.limits) × statefulset.replicas + system overhead
+```
+
+Example with the configuration above and `replicas: 3`:
+
+- runner: 512Mi × 3 = 1.5Gi
+- dind: 4Gi × 3 = 12Gi
+- total: ~13.5Gi minimum, excluding other workloads on the node
+
+Use `statefulset.nodeSelector` and `statefulset.tolerations` to place runners on dedicated nodes when needed.
+
+## Why not only set `statefulset.resources`?
+
+Before chart 0.1.2, one value was copied to **both** containers. **Requests** are where it
+hurts most: the scheduler reserves capacity per container, and both inherit the same numbers.
+
+```yaml
+# Only statefulset.resources — requests copied to runner AND dind:
+statefulset:
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2Gi      # what DinD needs…
+  # runner also requests 500m + 2Gi → pod ~1 CPU + ~4Gi reserved (mostly wasted)
+  # dind requests 500m + 2Gi ✓
+```
+
+```yaml
+statefulset:
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi    # what the runner actually needs…
+  # runner requests 100m + 256Mi ✓
+  # dind requests 100m + 256Mi too → tiny slot, builds starve ✗
+```
+
+```yaml
+# Separate overrides — scheduler sees the real footprint:
+statefulset:
+  resources: {}
+  runner:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+  dind:
+    resources:
+      requests:
+        cpu: 500m
+        memory: 2Gi
+  # pod requests ~600m CPU + ~2.25Gi RAM — not 1 CPU + 4Gi, nor 200m + 512Mi
+```
+
+Limits follow the same split. Unset overrides (`{}`) still fall back to `statefulset.resources`.

pnpm-lock.yaml

@@ -13,7 +13,7 @@ importers:
         version: 2.7.2
       markdownlint-cli:
         specifier: ^0.49.0
-        version: 0.49.0
+        version: 0.49.1
 
 packages:
 
@@ -133,8 +133,8 @@ packages:
     resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
     deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
 
-  ignore@7.0.5:
+  ignore@7.0.6:
-    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
+    resolution: {integrity: sha512-BAg6QkE8W+TuQLrrw0Ugr7HegXduRuuj8/ti2kSOc+jz1dmx8/WNcjr6XGnq5YpDWxFwwaavqD0+jIUOKelTsw==}
     engines: {node: '>= 4'}
 
   inflight@1.0.6:
@@ -144,9 +144,9 @@ packages:
   inherits@2.0.4:
     resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
 
-  ini@4.1.3:
+  ini@7.0.0:
-    resolution: {integrity: sha512-X7rqawQBvfdjS10YU1y1YVreA3SsLrW9dX2CewP2EbBJM4ypVNLDkO5y04gejPwKIY9lR+7r9gn3rFPt/kmWFg==}
+    resolution: {integrity: sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w==}
-    engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
+    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
 
   is-alphabetical@2.0.1:
     resolution: {integrity: sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==}
@@ -160,8 +160,8 @@ packages:
   is-hexadecimal@2.0.1:
     resolution: {integrity: sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==}
 
-  js-yaml@4.2.0:
+  js-yaml@5.2.1:
-    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
+    resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==}
     hasBin: true
 
   jsonc-parser@3.3.1:
@@ -181,24 +181,24 @@ packages:
   lodash@4.18.1:
     resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==}
 
-  markdown-it@14.2.0:
+  markdown-it@14.3.0:
-    resolution: {integrity: sha512-1TGiQiJVRQ3NPmZH6sx5Cfnmg6GQm9jvC1ch4TK511NjSJvjzKLzn5pPfZRNZkRPZP0HqCioSndqH8v2nRaWVQ==}
+    resolution: {integrity: sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==}
     hasBin: true
 
   markdown-table@2.0.0:
     resolution: {integrity: sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A==}
 
-  markdownlint-cli@0.49.0:
+  markdownlint-cli@0.49.1:
-    resolution: {integrity: sha512-vS5tWq5W91Gg33LD4pyAaXPclnz/sRvo6/RGOyDQjQ3eds2DkK6H4szUuE0M9TiRB/u/VBx1gtd9Ktrtx5WlSA==}
+    resolution: {integrity: sha512-qpYqJbSYf3jv57bdnFmCaZ/Wlu6IYHp2b6SOKrKBJ7OnPrDHIKmx4NERWH49QH9viTI6yO6raVDDn5nrf60VQQ==}
     engines: {node: '>=22'}
     hasBin: true
 
-  markdownlint@0.41.0:
+  markdownlint@0.41.1:
-    resolution: {integrity: sha512-xMUI3ChBuRuxuLF4ENvCZyS8z/+Jly1coUcZwErKLIB3sDj7ojpaTBa1e9YVPhSN4jGEIjYGQCldbTJS/hqS+A==}
+    resolution: {integrity: sha512-qHKeU2E1bdyNAT077go2FVTNXvYcktN5IHtF6XyeD1l0PClxzSp2tUApAV14ORI8DGX4H9bNKZEzelZp4qn8IA==}
     engines: {node: '>=22'}
 
-  mdurl@2.0.0:
+  mdurl@2.1.0:
-    resolution: {integrity: sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==}
+    resolution: {integrity: sha512-1+HBaOx0zi/dQWht8rNv9MYf9qqpqL/kxI0hXImU6Y547zM6Sni8BQibt7ifgMcYtQg41ao3Ivd6cnSM86inpg==}
 
   micromark-core-commonmark@2.0.3:
     resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==}
@@ -310,12 +310,12 @@ packages:
     resolution: {integrity: sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==}
     engines: {node: '>=0.10'}
 
-  run-con@1.3.2:
+  run-con@1.3.3:
-    resolution: {integrity: sha512-CcfE+mYiTcKEzg0IqS08+efdnH0oJ3zV0wSUFBNrMHMuxCtXvBCLzCJHatwuXDcu/RlhjTziTo/a1ruQik6/Yg==}
+    resolution: {integrity: sha512-Lb7OKM9aaykzyoNiHGhSVCjZsvbyy6qDMp2vDXL+MoCfz3GfNJtHYH7uYsU3QNMyInBk++xx+EZ8xZ8Sxs5fNQ==}
     hasBin: true
 
-  smol-toml@1.6.1:
+  smol-toml@1.7.0:
-    resolution: {integrity: sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==}
+    resolution: {integrity: sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==}
     engines: {node: '>= 18'}
 
   string-width@8.2.1:
@@ -438,7 +438,7 @@ snapshots:
       once: 1.4.0
       path-is-absolute: 1.0.1
 
-  ignore@7.0.5: {}
+  ignore@7.0.6: {}
 
   inflight@1.0.6:
     dependencies:
@@ -447,7 +447,7 @@ snapshots:
 
   inherits@2.0.4: {}
 
-  ini@4.1.3: {}
+  ini@7.0.0: {}
 
   is-alphabetical@2.0.1: {}
 
@@ -460,7 +460,7 @@ snapshots:
 
   is-hexadecimal@2.0.1: {}
 
-  js-yaml@4.2.0:
+  js-yaml@5.2.1:
     dependencies:
       argparse: 2.0.1
 
@@ -478,12 +478,12 @@ snapshots:
 
   lodash@4.18.1: {}
 
-  markdown-it@14.2.0:
+  markdown-it@14.3.0:
     dependencies:
       argparse: 2.0.1
       entities: 4.5.0
       linkify-it: 5.0.2
-      mdurl: 2.0.0
+      mdurl: 2.1.0
       punycode.js: 2.3.1
       uc.micro: 2.1.0
 
@@ -491,24 +491,24 @@ snapshots:
     dependencies:
       repeat-string: 1.6.1
 
-  markdownlint-cli@0.49.0:
+  markdownlint-cli@0.49.1:
     dependencies:
       commander: 15.0.0
       deep-extend: 0.6.0
-      ignore: 7.0.5
+      ignore: 7.0.6
-      js-yaml: 4.2.0
+      js-yaml: 5.2.1
       jsonc-parser: 3.3.1
       jsonpointer: 5.0.1
-      markdown-it: 14.2.0
+      markdown-it: 14.3.0
-      markdownlint: 0.41.0
+      markdownlint: 0.41.1
       minimatch: 10.2.5
-      run-con: 1.3.2
+      run-con: 1.3.3
-      smol-toml: 1.6.1
+      smol-toml: 1.7.0
       tinyglobby: 0.2.17
     transitivePeerDependencies:
       - supports-color
 
-  markdownlint@0.41.0:
+  markdownlint@0.41.1:
     dependencies:
       micromark: 4.0.2
       micromark-core-commonmark: 2.0.3
@@ -522,7 +522,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  mdurl@2.0.0: {}
+  mdurl@2.1.0: {}
 
   micromark-core-commonmark@2.0.3:
     dependencies:
@@ -730,14 +730,14 @@ snapshots:
 
   repeat-string@1.6.1: {}
 
-  run-con@1.3.2:
+  run-con@1.3.3:
     dependencies:
       deep-extend: 0.6.0
-      ini: 4.1.3
+      ini: 7.0.0
       minimist: 1.2.8
       strip-json-comments: 3.1.1
 
-  smol-toml@1.6.1: {}
+  smol-toml@1.7.0: {}
 
   string-width@8.2.1:
     dependencies:

templates/_helpers.tpl

@@ -116,6 +116,13 @@ Create image for the Gitea Actions Act Runner
 {{ include "gitea.actions.common.image" (dict "root" . "image" .Values.statefulset.runner) }}
 {{- end -}}
 
+{{/*
+Resolve resource requests/limits for the runner container.
+*/}}
+{{- define "gitea.actions.runner.resources" -}}
+{{- toYaml (default .Values.statefulset.resources .Values.statefulset.runner.resources) -}}
+{{- end -}}
+
 {{/*
 Create image for DinD
 */}}
@@ -123,6 +130,13 @@ Create image for DinD
 {{ include "gitea.actions.common.image" (dict "root" . "image" .Values.statefulset.dind) }}
 {{- end -}}
 
+{{/*
+Resolve resource requests/limits for the DinD container.
+*/}}
+{{- define "gitea.actions.dind.resources" -}}
+{{- toYaml (default .Values.statefulset.resources .Values.statefulset.dind.resources) -}}
+{{- end -}}
+
 {{/*
 Create image for Init
 */}}

templates/statefulset.yaml

@@ -120,7 +120,7 @@ spec:
                 - /var/run/docker.sock
                 {{- end }}
           resources:
-            {{- toYaml .Values.statefulset.resources | nindent 12 }}
+            {{- include "gitea.actions.dind.resources" . | nindent 12 }}
           volumeMounts:
             {{- if .Values.statefulset.dind.rootless }}
             - mountPath: /run/user/{{ .Values.statefulset.dind.uid | default 1000 }}/
@@ -155,7 +155,7 @@ spec:
             {{- toYaml .Values.statefulset.runner.extraEnvs | nindent 12 }}
             {{- end }}
           resources:
-            {{- toYaml .Values.statefulset.resources | nindent 12 }}
+            {{- include "gitea.actions.runner.resources" . | nindent 12 }}
           volumeMounts:
             - mountPath: /runner/config.yaml
               name: runner-config

unittests/helm/statefulset.yaml

@@ -451,3 +451,85 @@ tests:
       - equal:
           path: spec.template.spec.initContainers[0].image
           value: test.io/busybox:1.37.0
+
+#
+## RESOURCES
+#
+
+  - it: shared statefulset.resources applies to both runner and dind containers
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.resources:
+        requests:
+          memory: "512Mi"
+          cpu: "250m"
+        limits:
+          memory: "1Gi"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources
+          value:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "1Gi"
+      - equal:
+          path: spec.template.spec.initContainers[1].resources
+          value:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "1Gi"
+
+  - it: statefulset.runner.resources overrides shared resources for runner container only
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.resources:
+        requests:
+          memory: "512Mi"
+      statefulset.runner.resources:
+        requests:
+          memory: "256Mi"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources
+          value:
+            requests:
+              memory: "256Mi"
+      - equal:
+          path: spec.template.spec.initContainers[1].resources
+          value:
+            requests:
+              memory: "512Mi"
+
+  - it: statefulset.dind.resources overrides shared resources for dind container only
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.resources:
+        requests:
+          memory: "512Mi"
+      statefulset.dind.resources:
+        requests:
+          memory: "4Gi"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources
+          value:
+            requests:
+              memory: "512Mi"
+      - equal:
+          path: spec.template.spec.initContainers[1].resources
+          value:
+            requests:
+              memory: "4Gi"

values.yaml

@@ -1,12 +1,15 @@
 # Configure Gitea Actions
 ## @section Gitea Actions
+## @descriptionStart
+## For resource limit examples (runner vs DinD), see [docs/resources.md](./docs/resources.md).
+## @descriptionEnd
 #
 ## @param enabled Create a Gitea Runner StatefulSet.
 ## @param statefulset.replicas the amount of (replica) runner pods deployed
 ## @param statefulset.timezone is the timezone that will be set in the runner image
 ## @param statefulset.annotations Gitea Runner annotations
 ## @param statefulset.labels Gitea Runner labels
-## @param statefulset.resources Gitea Runner resources
+## @param statefulset.resources Shared resource requests/limits for both containers. Overridden by statefulset.runner.resources and statefulset.dind.resources. See docs/resources.md.
 ## @param statefulset.nodeSelector NodeSelector for the statefulset
 ## @param statefulset.tolerations Tolerations for the statefulset
 ## @param statefulset.affinity Affinity for the statefulset
@@ -25,6 +28,7 @@
 ## @param statefulset.runner.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
 ## @param statefulset.runner.pullPolicy The Gitea Runner pullPolicy
 ## @param statefulset.runner.fullOverride Completely overrides the image registry, path/image, tag and digest.
+## @param statefulset.runner.resources Resource requests/limits for the runner container. Takes precedence over statefulset.resources when set.
 ## @param statefulset.runner.extraVolumeMounts Allows mounting extra volumes in the Gitea Runner container
 ## @param statefulset.runner.extraEnvs Allows adding custom environment variables
 ## @param statefulset.runner.flushCache whether to clear the .runner (cache) file by creating an extra init container, can slightly increase boot-up time
@@ -38,6 +42,7 @@
 ## @param statefulset.dind.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
 ## @param statefulset.dind.fullOverride Completely overrides the image registry, path/image, tag and digest.
 ## @param statefulset.dind.pullPolicy The Docker-in-Docker pullPolicy
+## @param statefulset.dind.resources Resource requests/limits for the DinD sidecar container. Takes precedence over statefulset.resources when set.
 ## @param statefulset.dind.extraVolumeMounts Allows mounting extra volumes in the Docker-in-Docker container
 ## @param statefulset.dind.extraEnvs Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`
 ## @param statefulset.dind.extraArgs Allows adding custom arguments to the Docker Daemon
@@ -75,6 +80,7 @@ statefulset:
     digest: ""
     pullPolicy: IfNotPresent
     fullOverride: ""
+    resources: {}
     extraVolumeMounts: []
     extraEnvs:
       []
@@ -104,6 +110,7 @@ statefulset:
     digest: ""
     pullPolicy: IfNotPresent
     fullOverride: ""
+    resources: {}
     extraVolumeMounts: []
 
     # If the container keeps crashing in your environment, you might have to add the `DOCKER_IPTABLES_LEGACY` environment variable.