GH-5267: fix(helm+docs): phantom --set examples and fictional existingSecret flow remain; add helm lint/template CI

[alekspetrov]

Summary

Automated PR created by Pilot for task GH-5267.

Closes #5267

Changes

GitHub Issue GH-5267: fix(helm+docs): phantom --set examples and fictional existingSecret flow remain; add helm lint/template CI

Problem

Residual drifts from the PR#5265 post-merge review (notes N1-N3 + finding 5) — same class the parent fixed, adjacent sections:

1. Install tabs in docs/content/deployment/docker-helm.mdx (~227, ~239) still use the nonexistent config. prefix in --set examples (--set config.adapters.github.repo=...) — silent no-ops.
2. --set existingSecret=pilot-secrets appears at ~238 and ~798, but no existingSecret key exists anywhere in the chart — the documented "recommended" secrets flow is fictional. Either implement the key (standard helm pattern: honor an existing secret name in deployment.yaml/secret.yaml) or rewrite the docs to the chart-managed secret; implementing is the conventional choice, but keep it small.
3. The new comment in deploy/helm/pilot/templates/configmap.yaml says the old top-level block "binds to config.Orchestrator.Autopilot.Environment via the lift" — imprecise: the lift moves the whole block, and the old mode: key inside binds to nothing (the field's yaml tag is environment). Fix the wording.
4. No CI validates the chart: no workflow runs helm lint or helm template. Add a small job (helm lint + template with default values + grep the render for a top-level autopilot key) so this drift class fails loudly next time.

Acceptance

• Every --set example in docker-helm.mdx round-trips against values.yaml (keys exist, paths real).
• The secrets flow documented is one the chart actually implements.
• Chart comment wording accurate.
• CI job renders + lints the chart on PRs touching deploy/helm/** or the docker-helm docs page.

Refs

• PR#5265 review (notes N1-N3, finding 5) · fix(helm): chart renders a no-op top-level autopilot block + docs values example drifts from real values.yaml #5262 (parent)

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[alekspetrov]

Post-merge review — APPROVE (w-notes)

Verified against merged main (0fcc6899):

1. No phantom keys introduced (the disease this class fixes): adapters.github.repo genuinely binds — internal/adapters/github/types.go:14 yaml:"repo". Conditional render in configmap.yaml correct.
2. existingSecret made real, correctly: secret.yaml gated on not .Values.existingSecret, pilot.secretName helper applied to all 6 secretKeyRef sites, checksum/secret annotation gated off when external. The previously-fictional docs flow now round-trips.
3. Every --set example in docker-helm.mdx round-trips — checked all of them against values.yaml, including the previously-unfixed sites: existingSecret (~806), ingress.*, persistence.size, metrics.serviceMonitor.enabled, image.tag. The config. prefix is gone.
4. Comment wording now accurate: verified autopilot.Config.Environment is yaml-tagged environment (internal/autopilot/types.go:92) and liftTopLevelAutopilot decodes the raw block's keys — so a mode: key indeed binds to nothing even after the lift.
5. CI job is non-vacuous — checked the job log, not just the green check (7s runtime looked suspicious): the log shows helm lint (1 chart, 0 failed), both helm template renders, and both grep guards actually executing on this PR. The fix(config): documented top-level autopilot block is silently ignored — loader only reads orchestrator.autopilot #5251 regression guard greps a real render.

Notes (no action required):

• N1 Change-detection on push uses github.event.before, which is the zero SHA on branch creation/force push → git diff errors inside the if → silently changed=false → chart checks skip that push. Rare; the PR path is sound.
• N2 Docs↔values drift itself isn't validated (the mdx file triggers the job but only the chart is checked) — a future phantom --set in docs alone still passes. Out of scope per the issue's "keep it small".
• N3 With existingSecret set, external Secret rotation no longer restarts the pod (checksum gated off) — standard helm trade-off; worth one docs line eventually.