chore: bump dind and runner

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJraW5kL2RlcGVuZGVuY3kiXX0=-->

Reviewed-on: https://gitea.com/gitea/helm-actions/pulls/170
Reviewed-by: DaanSelen <135789+daanselen@noreply.gitea.com>
Co-authored-by: Renovate Bot <renovate-bot@gitea.com>

.gitea/workflows/changelog.yml

@@ -8,12 +8,12 @@ on:
 jobs:
   changelog:
     runs-on: ubuntu-latest
-    container: docker.io/thegeeklab/git-sv:2.1.3
+    container: docker.io/thegeeklab/git-sv:3.0.0
     steps:
       - name: install tools
         run: |
           apk add -q --update --no-cache nodejs curl jq sed
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Generate upcoming changelog

.gitea/workflows/commitlint.yml

@@ -11,9 +11,9 @@ on:
 jobs:
   check-and-test:
     runs-on: ubuntu-latest
-    container: commitlint/commitlint:21.2.0
+    container: commitlint/commitlint:21.2.1
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: check PR title
         run: |
           echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json

.gitea/workflows/release-version.yml

@@ -7,20 +7,20 @@ on:
 
 env:
   # renovate: datasource=docker depName=alpine/helm
-  HELM_VERSION: "4.2.2"
+  HELM_VERSION: "4.2.3"
 
 jobs:
   generate-chart-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: install Docker CLI
-        uses: https://github.com/docker/setup-buildx-action@v4 # Gitea
+        uses: https://github.com/docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 # Gitea
         #uses: docker/setup-buildx-action@v4 # Github / Act
 
       - name: install Helm
-        uses: https://github.com/Azure/setup-helm@v5 # Gitea
+        uses: https://github.com/Azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5 # Gitea
         #uses: Azure/setup-helm@v5 # Github / Act
         with:
           version: "${{ env.HELM_VERSION }}"
@@ -33,7 +33,7 @@ jobs:
 
       - name: import GPG key
         id: import_gpg
-        uses: https://github.com/crazy-max/ghaction-import-gpg@v7 # Gitea
+        uses: https://github.com/crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7 # Gitea
         #uses: crazy-max/ghaction-import-gpg@v7 # Github / Act
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
@@ -41,7 +41,7 @@ jobs:
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
 
       - name: log into Docker Hub
-        uses: https://github.com/docker/login-action@v4 # Gitea
+        uses: https://github.com/docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 # Gitea
         #uses: docker/login-action@v4 # Github / Act
         with:
           username: ${{ secrets.DOCKER_CHARTS_USERNAME }}
@@ -68,7 +68,7 @@ jobs:
           TAR_OPTIONS: "--wildcards"
 
       - name: aws credential configure
-        uses: https://github.com/aws-actions/configure-aws-credentials@v6 # Gitea
+        uses: https://github.com/aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6 # Gitea
         #uses: aws-actions/configure-aws-credentials@v6 # Github / Act
         with:
           aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
@@ -79,3 +79,13 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         run: |
           aws s3 sync actions/ s3://${{ secrets.AWS_S3_BUCKET}}/charts/
+
+      - name: Copy files to Cloudflare R2
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: auto
+          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
+          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+        run: |
+          aws s3 sync actions/ s3://${CLOUDFLARE_R2_BUCKET}/charts/ --endpoint-url https://${CLOUDFLARE_R2_ACCOUNT_ID}.r2.cloudflarestorage.com

.gitea/workflows/shellcheck.yml

@@ -9,6 +9,6 @@ jobs:
   shellcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - run: apt update --yes && apt install --yes shellcheck
       - run: find . -type f -name "*.sh" -exec shellcheck -a {} \;

.gitea/workflows/test-pr.yml

@@ -11,22 +11,22 @@ name: check-and-test
 
 env:
   # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
-  HELM_UNITTEST_VERSION: "v1.1.1"
+  HELM_UNITTEST_VERSION: "v1.1.2"
 
 jobs:
   check-and-test:
     runs-on: ubuntu-latest
-    container: alpine/helm:4.2.2
+    container: alpine/helm:4.2.3
     steps:
       - name: install tools
         run: |
           apk update
           apk add --update bash make nodejs npm yamllint ncurses
       - name: Install pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           version: 11
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: install chart dependencies
         run: helm dependency build
       - name: lint
@@ -49,4 +49,4 @@ jobs:
           git diff --exit-code --name-only README.md
       - name: yaml lint
         # uses: ibiqlik/action-yamllint@v3 # Github / Act
-        uses: https://github.com/ibiqlik/action-yamllint@v3 # Gitea
+        uses: https://github.com/ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3 # Gitea

README.md

@@ -65,14 +65,16 @@ If `.Values.statefulset.dind.rootless: true` is set, then the following will be
 
 ### Gitea Actions
 
+For resource limit examples (runner vs DinD), see [docs/resources.md](./docs/resources.md).
+
 | Name                                   | Description                                                                                                                                            | Value                          |
-| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
 | `enabled`                              | Create a Gitea Runner StatefulSet.                                                                                                                     | `false`                        |
 | `statefulset.replicas`                 | the amount of (replica) runner pods deployed                                                                                                           | `1`                            |
 | `statefulset.timezone`                 | is the timezone that will be set in the runner image                                                                                                   | `Etc/UTC`                      |
 | `statefulset.annotations`              | Gitea Runner annotations                                                                                                                               | `{}`                           |
 | `statefulset.labels`                   | Gitea Runner labels                                                                                                                                    | `{}`                           |
-| `statefulset.resources`                | Gitea Runner resources                                                                                                                          | `{}`                           |
+| `statefulset.resources`                | Shared resource requests/limits for both containers. Overridden by statefulset.runner.resources and statefulset.dind.resources. See docs/resources.md. | `{}`                           |
 | `statefulset.nodeSelector`             | NodeSelector for the statefulset                                                                                                                       | `{}`                           |
 | `statefulset.tolerations`              | Tolerations for the statefulset                                                                                                                        | `[]`                           |
 | `statefulset.affinity`                 | Affinity for the statefulset                                                                                                                           | `{}`                           |
@@ -89,6 +91,7 @@ If `.Values.statefulset.dind.rootless: true` is set, then the following will be
 | `statefulset.runner.digest`            | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`                                             | `""`                           |
 | `statefulset.runner.pullPolicy`        | The Gitea Runner pullPolicy                                                                                                                            | `IfNotPresent`                 |
 | `statefulset.runner.fullOverride`      | Completely overrides the image registry, path/image, tag and digest.                                                                                   | `""`                           |
+| `statefulset.runner.resources`         | Resource requests/limits for the runner container. Takes precedence over statefulset.resources when set.                                               | `{}`                           |
 | `statefulset.runner.extraVolumeMounts` | Allows mounting extra volumes in the Gitea Runner container                                                                                            | `[]`                           |
 | `statefulset.runner.extraEnvs`         | Allows adding custom environment variables                                                                                                             | `[]`                           |
 | `statefulset.runner.flushCache`        | whether to clear the .runner (cache) file by creating an extra init container, can slightly increase boot-up time                                      | `false`                        |
@@ -101,6 +104,7 @@ If `.Values.statefulset.dind.rootless: true` is set, then the following will be
 | `statefulset.dind.digest`              | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`                                             | `""`                           |
 | `statefulset.dind.fullOverride`        | Completely overrides the image registry, path/image, tag and digest.                                                                                   | `""`                           |
 | `statefulset.dind.pullPolicy`          | The Docker-in-Docker pullPolicy                                                                                                                        | `IfNotPresent`                 |
+| `statefulset.dind.resources`           | Resource requests/limits for the DinD sidecar container. Takes precedence over statefulset.resources when set.                                         | `{}`                           |
 | `statefulset.dind.extraVolumeMounts`   | Allows mounting extra volumes in the Docker-in-Docker container                                                                                        | `[]`                           |
 | `statefulset.dind.extraEnvs`           | Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`                                                                           | `[]`                           |
 | `statefulset.dind.extraArgs`           | Allows adding custom arguments to the Docker Daemon                                                                                                    | `[]`                           |

docs/README.md

@@ -1,3 +1,4 @@
 # Gitea Actions Helm Chart Docs
 
+- [Resource limits and capacity](./resources.md)
 - [connectionCommandOverride explanation](./connectionCommandOverride.md)

docs/resources.md

@@ -0,0 +1,173 @@
+# Resource limits and capacity
+
+By default, all resource values are empty (`{}`). Without explicit limits, runner pods can consume unbounded CPU and memory on a node. This guide explains how to configure resource usage properly.
+
+## Pod architecture
+
+Each runner pod contains two resource-consuming containers:
+
+| Container | Role | Helm value |
+| --- | --- | --- |
+| `runner` | Polls Gitea and orchestrates CI jobs | `statefulset.runner.resources` |
+| `dind` | Docker-in-Docker daemon; executes job containers | `statefulset.dind.resources` |
+
+The DinD container runs as a native sidecar (`initContainer` with `restartPolicy: Always`).
+
+## Helm resource keys
+
+Three values control Kubernetes resource requests and limits:
+
+| Key | Purpose |
+| --- | --- |
+| `statefulset.resources` | Shared fallback applied to **both** containers when no override is set |
+| `statefulset.runner.resources` | Override for the `runner` container only |
+| `statefulset.dind.resources` | Override for the `dind` container only |
+
+Precedence:
+
+```text
+statefulset.runner.resources  →  else statefulset.resources
+statefulset.dind.resources    →  else statefulset.resources
+```
+
+**Recommendation:** set `statefulset.runner.resources` and `statefulset.dind.resources`
+explicitly instead of relying on the shared fallback. The runner process is lightweight;
+DinD and CI workloads need most of the budget.
+
+## Example: separate runner and DinD limits
+
+```yaml
+enabled: true
+giteaRootURL: https://gitea.example.com
+existingSecret: runner-secret
+existingSecretKey: runner-token
+
+statefulset:
+  replicas: 1
+
+  runner:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
+    config: |
+      log:
+        level: info
+      cache:
+        enabled: false
+      runner:
+        capacity: 1
+      container:
+        require_docker: true
+        docker_timeout: 300s
+
+  dind:
+    resources:
+      requests:
+        cpu: 500m
+        memory: 2Gi
+      limits:
+        cpu: 2
+        memory: 4Gi
+```
+
+## Two layers of limiting
+
+Kubernetes limits and act-runner job limits serve different purposes. Use both for a robust setup.
+
+### 1. Kubernetes limits (Helm values)
+
+These apply to the `runner` and `dind` containers in the pod.
+
+- **`dind` limits** cap the Docker daemon and everything it runs inside the pod (images, build caches, job containers).
+- **`runner` limits** cap the act-runner process itself.
+
+If neither is set, a runaway build can exhaust the entire node.
+
+### 2. Per-job Docker limits (`container.options`)
+
+CI jobs run as Docker containers spawned by act-runner through the Docker socket. They are
+**not** separate Kubernetes containers. Configure per-job limits in `statefulset.runner.config`
+— see [act-runner configuration](https://docs.gitea.com/usage/actions/act-runner#configuration)
+and [config.example.yaml](https://gitea.com/gitea/runner/src/branch/main/internal/pkg/config/config.example.yaml).
+
+## act-runner settings that affect resource usage
+
+Settings such as `runner.capacity` and `container.options` live in `statefulset.runner.config`, not in the Helm resource values. Refer to the runner documentation for details:
+
+- [act-runner configuration](https://docs.gitea.com/usage/actions/act-runner#configuration)
+- [config.example.yaml](https://gitea.com/gitea/runner/src/branch/main/internal/pkg/config/config.example.yaml) in the [Gitea/runner](https://gitea.com/gitea/runner) repository
+
+When concurrent jobs or per-job Docker limits increase expected load, size `statefulset.dind.resources` accordingly on the Helm side.
+
+## Capacity planning
+
+These formulas apply to the Helm resource values (`statefulset.runner.resources`, `statefulset.dind.resources`, `statefulset.replicas`):
+
+### Per pod
+
+```text
+pod budget ≈ runner.limits + dind.limits
+```
+
+### Per node
+
+```text
+node budget ≈ (runner.limits + dind.limits) × statefulset.replicas + system overhead
+```
+
+Example with the configuration above and `replicas: 3`:
+
+- runner: 512Mi × 3 = 1.5Gi
+- dind: 4Gi × 3 = 12Gi
+- total: ~13.5Gi minimum, excluding other workloads on the node
+
+Use `statefulset.nodeSelector` and `statefulset.tolerations` to place runners on dedicated nodes when needed.
+
+## Why not only set `statefulset.resources`?
+
+Before chart 0.1.2, one value was copied to **both** containers. **Requests** are where it
+hurts most: the scheduler reserves capacity per container, and both inherit the same numbers.
+
+```yaml
+# Only statefulset.resources — requests copied to runner AND dind:
+statefulset:
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2Gi      # what DinD needs…
+  # runner also requests 500m + 2Gi → pod ~1 CPU + ~4Gi reserved (mostly wasted)
+  # dind requests 500m + 2Gi ✓
+```
+
+```yaml
+statefulset:
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi    # what the runner actually needs…
+  # runner requests 100m + 256Mi ✓
+  # dind requests 100m + 256Mi too → tiny slot, builds starve ✗
+```
+
+```yaml
+# Separate overrides — scheduler sees the real footprint:
+statefulset:
+  resources: {}
+  runner:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+  dind:
+    resources:
+      requests:
+        cpu: 500m
+        memory: 2Gi
+  # pod requests ~600m CPU + ~2.25Gi RAM — not 1 CPU + 4Gi, nor 200m + 512Mi
+```
+
+Limits follow the same split. Unset overrides (`{}`) still fall back to `statefulset.resources`.

pnpm-lock.yaml

@@ -13,7 +13,7 @@ importers:
         version: 2.7.2
       markdownlint-cli:
         specifier: ^0.49.0
-        version: 0.49.0
+        version: 0.49.1
 
 packages:
 
@@ -50,9 +50,9 @@ packages:
   brace-expansion@1.1.16:
     resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==}
 
-  brace-expansion@5.0.7:
-    resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==}
-    engines: {node: 18 || 20 || >=22}
+  brace-expansion@5.0.8:
+    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
+    engines: {node: 20 || >=22}
 
   character-entities-legacy@3.0.0:
     resolution: {integrity: sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==}
@@ -144,9 +144,9 @@ packages:
   inherits@2.0.4:
     resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
 
-  ini@4.1.3:
-    resolution: {integrity: sha512-X7rqawQBvfdjS10YU1y1YVreA3SsLrW9dX2CewP2EbBJM4ypVNLDkO5y04gejPwKIY9lR+7r9gn3rFPt/kmWFg==}
-    engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
+  ini@7.0.0:
+    resolution: {integrity: sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w==}
+    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
 
   is-alphabetical@2.0.1:
     resolution: {integrity: sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==}
@@ -160,8 +160,8 @@ packages:
   is-hexadecimal@2.0.1:
     resolution: {integrity: sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==}
 
-  js-yaml@4.2.0:
-    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
+  js-yaml@5.2.2:
+    resolution: {integrity: sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==}
     hasBin: true
 
   jsonc-parser@3.3.1:
@@ -181,24 +181,24 @@ packages:
   lodash@4.18.1:
     resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==}
 
-  markdown-it@14.2.0:
-    resolution: {integrity: sha512-1TGiQiJVRQ3NPmZH6sx5Cfnmg6GQm9jvC1ch4TK511NjSJvjzKLzn5pPfZRNZkRPZP0HqCioSndqH8v2nRaWVQ==}
+  markdown-it@14.3.0:
+    resolution: {integrity: sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==}
     hasBin: true
 
   markdown-table@2.0.0:
     resolution: {integrity: sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A==}
 
-  markdownlint-cli@0.49.0:
-    resolution: {integrity: sha512-vS5tWq5W91Gg33LD4pyAaXPclnz/sRvo6/RGOyDQjQ3eds2DkK6H4szUuE0M9TiRB/u/VBx1gtd9Ktrtx5WlSA==}
+  markdownlint-cli@0.49.1:
+    resolution: {integrity: sha512-qpYqJbSYf3jv57bdnFmCaZ/Wlu6IYHp2b6SOKrKBJ7OnPrDHIKmx4NERWH49QH9viTI6yO6raVDDn5nrf60VQQ==}
     engines: {node: '>=22'}
     hasBin: true
 
-  markdownlint@0.41.0:
-    resolution: {integrity: sha512-xMUI3ChBuRuxuLF4ENvCZyS8z/+Jly1coUcZwErKLIB3sDj7ojpaTBa1e9YVPhSN4jGEIjYGQCldbTJS/hqS+A==}
+  markdownlint@0.41.1:
+    resolution: {integrity: sha512-qHKeU2E1bdyNAT077go2FVTNXvYcktN5IHtF6XyeD1l0PClxzSp2tUApAV14ORI8DGX4H9bNKZEzelZp4qn8IA==}
     engines: {node: '>=22'}
 
-  mdurl@2.0.0:
-    resolution: {integrity: sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==}
+  mdurl@2.1.0:
+    resolution: {integrity: sha512-1+HBaOx0zi/dQWht8rNv9MYf9qqpqL/kxI0hXImU6Y547zM6Sni8BQibt7ifgMcYtQg41ao3Ivd6cnSM86inpg==}
 
   micromark-core-commonmark@2.0.3:
     resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==}
@@ -310,12 +310,12 @@ packages:
     resolution: {integrity: sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==}
     engines: {node: '>=0.10'}
 
-  run-con@1.3.2:
-    resolution: {integrity: sha512-CcfE+mYiTcKEzg0IqS08+efdnH0oJ3zV0wSUFBNrMHMuxCtXvBCLzCJHatwuXDcu/RlhjTziTo/a1ruQik6/Yg==}
+  run-con@1.3.3:
+    resolution: {integrity: sha512-Lb7OKM9aaykzyoNiHGhSVCjZsvbyy6qDMp2vDXL+MoCfz3GfNJtHYH7uYsU3QNMyInBk++xx+EZ8xZ8Sxs5fNQ==}
     hasBin: true
 
-  smol-toml@1.6.1:
-    resolution: {integrity: sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==}
+  smol-toml@1.7.0:
+    resolution: {integrity: sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==}
     engines: {node: '>= 18'}
 
   string-width@8.2.1:
@@ -378,7 +378,7 @@ snapshots:
       balanced-match: 1.0.2
       concat-map: 0.0.1
 
-  brace-expansion@5.0.7:
+  brace-expansion@5.0.8:
     dependencies:
       balanced-match: 4.0.4
 
@@ -447,7 +447,7 @@ snapshots:
 
   inherits@2.0.4: {}
 
-  ini@4.1.3: {}
+  ini@7.0.0: {}
 
   is-alphabetical@2.0.1: {}
 
@@ -460,7 +460,7 @@ snapshots:
 
   is-hexadecimal@2.0.1: {}
 
-  js-yaml@4.2.0:
+  js-yaml@5.2.2:
     dependencies:
       argparse: 2.0.1
 
@@ -478,12 +478,12 @@ snapshots:
 
   lodash@4.18.1: {}
 
-  markdown-it@14.2.0:
+  markdown-it@14.3.0:
     dependencies:
       argparse: 2.0.1
       entities: 4.5.0
       linkify-it: 5.0.2
-      mdurl: 2.0.0
+      mdurl: 2.1.0
       punycode.js: 2.3.1
       uc.micro: 2.1.0
 
@@ -491,24 +491,24 @@ snapshots:
     dependencies:
       repeat-string: 1.6.1
 
-  markdownlint-cli@0.49.0:
+  markdownlint-cli@0.49.1:
     dependencies:
       commander: 15.0.0
       deep-extend: 0.6.0
       ignore: 7.0.6
-      js-yaml: 4.2.0
+      js-yaml: 5.2.2
       jsonc-parser: 3.3.1
       jsonpointer: 5.0.1
-      markdown-it: 14.2.0
-      markdownlint: 0.41.0
+      markdown-it: 14.3.0
+      markdownlint: 0.41.1
       minimatch: 10.2.5
-      run-con: 1.3.2
-      smol-toml: 1.6.1
+      run-con: 1.3.3
+      smol-toml: 1.7.0
       tinyglobby: 0.2.17
     transitivePeerDependencies:
       - supports-color
 
-  markdownlint@0.41.0:
+  markdownlint@0.41.1:
     dependencies:
       micromark: 4.0.2
       micromark-core-commonmark: 2.0.3
@@ -522,7 +522,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  mdurl@2.0.0: {}
+  mdurl@2.1.0: {}
 
   micromark-core-commonmark@2.0.3:
     dependencies:
@@ -698,7 +698,7 @@ snapshots:
 
   minimatch@10.2.5:
     dependencies:
-      brace-expansion: 5.0.7
+      brace-expansion: 5.0.8
 
   minimatch@3.1.5:
     dependencies:
@@ -730,14 +730,14 @@ snapshots:
 
   repeat-string@1.6.1: {}
 
-  run-con@1.3.2:
+  run-con@1.3.3:
     dependencies:
       deep-extend: 0.6.0
-      ini: 4.1.3
+      ini: 7.0.0
       minimist: 1.2.8
       strip-json-comments: 3.1.1
 
-  smol-toml@1.6.1: {}
+  smol-toml@1.7.0: {}
 
   string-width@8.2.1:
     dependencies:

templates/_helpers.tpl

@@ -116,6 +116,13 @@ Create image for the Gitea Actions Act Runner
 {{ include "gitea.actions.common.image" (dict "root" . "image" .Values.statefulset.runner) }}
 {{- end -}}
 
+{{/*
+Resolve resource requests/limits for the runner container.
+*/}}
+{{- define "gitea.actions.runner.resources" -}}
+{{- toYaml (default .Values.statefulset.resources .Values.statefulset.runner.resources) -}}
+{{- end -}}
+
 {{/*
 Create image for DinD
 */}}
@@ -123,6 +130,13 @@ Create image for DinD
 {{ include "gitea.actions.common.image" (dict "root" . "image" .Values.statefulset.dind) }}
 {{- end -}}
 
+{{/*
+Resolve resource requests/limits for the DinD container.
+*/}}
+{{- define "gitea.actions.dind.resources" -}}
+{{- toYaml (default .Values.statefulset.resources .Values.statefulset.dind.resources) -}}
+{{- end -}}
+
 {{/*
 Create image for Init
 */}}

templates/statefulset.yaml

@@ -120,7 +120,7 @@ spec:
                 - /var/run/docker.sock
                 {{- end }}
           resources:
-            {{- toYaml .Values.statefulset.resources | nindent 12 }}
+            {{- include "gitea.actions.dind.resources" . | nindent 12 }}
           volumeMounts:
             {{- if .Values.statefulset.dind.rootless }}
             - mountPath: /run/user/{{ .Values.statefulset.dind.uid | default 1000 }}/
@@ -155,7 +155,7 @@ spec:
             {{- toYaml .Values.statefulset.runner.extraEnvs | nindent 12 }}
             {{- end }}
           resources:
-            {{- toYaml .Values.statefulset.resources | nindent 12 }}
+            {{- include "gitea.actions.runner.resources" . | nindent 12 }}
           volumeMounts:
             - mountPath: /runner/config.yaml
               name: runner-config

unittests/helm/statefulset.yaml

@@ -451,3 +451,85 @@ tests:
       - equal:
           path: spec.template.spec.initContainers[0].image
           value: test.io/busybox:1.37.0
+
+#
+## RESOURCES
+#
+
+  - it: shared statefulset.resources applies to both runner and dind containers
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.resources:
+        requests:
+          memory: "512Mi"
+          cpu: "250m"
+        limits:
+          memory: "1Gi"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources
+          value:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "1Gi"
+      - equal:
+          path: spec.template.spec.initContainers[1].resources
+          value:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "1Gi"
+
+  - it: statefulset.runner.resources overrides shared resources for runner container only
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.resources:
+        requests:
+          memory: "512Mi"
+      statefulset.runner.resources:
+        requests:
+          memory: "256Mi"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources
+          value:
+            requests:
+              memory: "256Mi"
+      - equal:
+          path: spec.template.spec.initContainers[1].resources
+          value:
+            requests:
+              memory: "512Mi"
+
+  - it: statefulset.dind.resources overrides shared resources for dind container only
+    template: templates/statefulset.yaml
+    set:
+      enabled: true
+      statefulset.resources:
+        requests:
+          memory: "512Mi"
+      statefulset.dind.resources:
+        requests:
+          memory: "4Gi"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources
+          value:
+            requests:
+              memory: "512Mi"
+      - equal:
+          path: spec.template.spec.initContainers[1].resources
+          value:
+            requests:
+              memory: "4Gi"

values.yaml

@@ -1,12 +1,15 @@
 # Configure Gitea Actions
 ## @section Gitea Actions
+## @descriptionStart
+## For resource limit examples (runner vs DinD), see [docs/resources.md](./docs/resources.md).
+## @descriptionEnd
 #
 ## @param enabled Create a Gitea Runner StatefulSet.
 ## @param statefulset.replicas the amount of (replica) runner pods deployed
 ## @param statefulset.timezone is the timezone that will be set in the runner image
 ## @param statefulset.annotations Gitea Runner annotations
 ## @param statefulset.labels Gitea Runner labels
-## @param statefulset.resources Gitea Runner resources
+## @param statefulset.resources Shared resource requests/limits for both containers. Overridden by statefulset.runner.resources and statefulset.dind.resources. See docs/resources.md.
 ## @param statefulset.nodeSelector NodeSelector for the statefulset
 ## @param statefulset.tolerations Tolerations for the statefulset
 ## @param statefulset.affinity Affinity for the statefulset
@@ -25,6 +28,7 @@
 ## @param statefulset.runner.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
 ## @param statefulset.runner.pullPolicy The Gitea Runner pullPolicy
 ## @param statefulset.runner.fullOverride Completely overrides the image registry, path/image, tag and digest.
+## @param statefulset.runner.resources Resource requests/limits for the runner container. Takes precedence over statefulset.resources when set.
 ## @param statefulset.runner.extraVolumeMounts Allows mounting extra volumes in the Gitea Runner container
 ## @param statefulset.runner.extraEnvs Allows adding custom environment variables
 ## @param statefulset.runner.flushCache whether to clear the .runner (cache) file by creating an extra init container, can slightly increase boot-up time
@@ -38,6 +42,7 @@
 ## @param statefulset.dind.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
 ## @param statefulset.dind.fullOverride Completely overrides the image registry, path/image, tag and digest.
 ## @param statefulset.dind.pullPolicy The Docker-in-Docker pullPolicy
+## @param statefulset.dind.resources Resource requests/limits for the DinD sidecar container. Takes precedence over statefulset.resources when set.
 ## @param statefulset.dind.extraVolumeMounts Allows mounting extra volumes in the Docker-in-Docker container
 ## @param statefulset.dind.extraEnvs Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`
 ## @param statefulset.dind.extraArgs Allows adding custom arguments to the Docker Daemon
@@ -71,10 +76,11 @@ statefulset:
   runner:
     registry: "docker.gitea.com"
     repository: runner
-    tag: 2.0.1
+    tag: 3.0.2
     digest: ""
     pullPolicy: IfNotPresent
     fullOverride: ""
+    resources: {}
     extraVolumeMounts: []
     extraEnvs:
       []
@@ -100,10 +106,11 @@ statefulset:
     uid: ""
     registry: "docker.io"
     repository: docker
-    tag: 29.5.2-dind
+    tag: 29.7.1-dind
     digest: ""
     pullPolicy: IfNotPresent
     fullOverride: ""
+    resources: {}
     extraVolumeMounts: []
 
     # If the container keeps crashing in your environment, you might have to add the `DOCKER_IPTABLES_LEGACY` environment variable.