chore: bump chart appVersion to 1.6.3-2 [skip ci]

- Introduced artifacthub-repo.yml for ownership verification on ArtifactHub.
- Updated release-chart.yaml to publish the ArtifactHub metadata as an OCI artifact.
- Bumped chart version to 0.2.2 and added relevant changes to Chart.yaml.
- Enhanced job-reconcile.yaml by adding a writable /tmp directory for the reconcile job.

.gitea/workflows/release-chart.yaml

@@ -25,6 +25,10 @@ name: Release chart
 # generic OCI artifacts, and a chart sharing the exact repository path with
 # the container image of the same name makes the package listing/type
 # ambiguous. A distinct `charts/` path keeps the two package kinds apart.
+#
+# Also pushes charts/aptly/artifacthub-repo.yml as a companion OCI artifact
+# (tag `artifacthub.io`) on every run, proving ownership of this repository
+# to ArtifactHub — see the "Publish ArtifactHub repository metadata" step.
 on:
   release:
     types: [published]
@@ -104,6 +108,22 @@ jobs:
             --username "${{ secrets.REGISTRY_USER }}" --password-stdin
           helm push "aptly-${{ steps.version.outputs.version }}.tgz" oci://git.morlana.online/f.weber/charts
 
+      # Publishes charts/aptly/artifacthub-repo.yml as its own OCI artifact
+      # (tag `artifacthub.io`) next to the chart — this is how ArtifactHub
+      # verifies ownership of an OCI-based Helm repository; there's no
+      # index.yaml it could otherwise crawl a metadata file out of. Uses the
+      # same registry credentials as the chart push above, nothing
+      # ArtifactHub-specific is needed (ArtifactHub has no publish API to
+      # authenticate against — it only reads the registry).
+      - uses: oras-project/setup-oras@v1
+      - name: Publish ArtifactHub repository metadata (ownership verification)
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" | oras login git.morlana.online \
+            --username "${{ secrets.REGISTRY_USER }}" --password-stdin
+          oras push git.morlana.online/f.weber/charts/aptly:artifacthub.io \
+            --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
+            charts/aptly/artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml
+
       - name: Attach chart artifacts to the Gitea release
         uses: softprops/action-gh-release@v2
         with:

charts/aptly/Chart.yaml

@@ -5,8 +5,8 @@ description: >-
   an nginx read/auth sidecar, a fully aptly-native values API, and declarative
   repo/mirror/publish state reconciled via a Helm hook.
 type: application
-version: 0.2.1
+version: 0.2.2
-appVersion: "1.6.3-1"
+appVersion: "1.6.3-2"
 home: https://git.morlana.online/f.weber/aptly-containerized
 sources:
   - https://git.morlana.online/f.weber/aptly-containerized
@@ -32,5 +32,7 @@ annotations:
     fingerprint: FC35C0FAA26605C4C21C7BBFBF43884145E5AA94
     url: https://git.morlana.online/f.weber/aptly-containerized/raw/branch/main/pubkeys/chart-signing.asc
   artifacthub.io/changes: |
+    - kind: added
+      description: Repository ownership verification for ArtifactHub (charts/aptly/artifacthub-repo.yml), published as a companion OCI artifact by release-chart.yaml.
     - kind: fixed
-      description: The aptly container's startup/readiness/liveness probes now exec curl against 127.0.0.1 instead of using httpGet. httpGet probes are dialed by kubelet against the pod IP, not localhost — since aptly listens on 127.0.0.1 only (by design, see proxy.enabled), that connection was always refused, leaving the pod stuck failing its startup probe forever despite aptly actually being healthy.
+      description: The reconcile Job's container had readOnlyRootFilesystem but no writable /tmp, so its own API client's scratch files failed to write ("Read-only file system") and every reconcile call died with a misleading "connection" error. A /tmp emptyDir is now mounted there too, matching the aptly/nginx containers in the StatefulSet.

charts/aptly/artifacthub-repo.yml

@@ -0,0 +1,6 @@
+repositoryID: "1ed468a7-7886-48ad-8835-369bc8a06bc5"
+owners:
+  - name: Morlana
+    email: contact@morlana.net
+  - name: Florian Weber
+    email: f.weber@flweber.me

charts/aptly/templates/job-reconcile.yaml

@@ -75,10 +75,14 @@ spec:
               mountPath: /state.yaml
               subPath: state.yaml
               readOnly: true
+            - name: tmp
+              mountPath: /tmp
           resources:
             {{- toYaml .Values.reconcile.resources | nindent 12 }}
       volumes:
         - name: state
           configMap:
             name: {{ $fullname }}-state
+        - name: tmp
+          emptyDir: {}
 {{- end }}

images/aptly-server/Dockerfile

@@ -64,7 +64,7 @@ LABEL org.opencontainers.image.title="aptly-server" \
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install -y --no-install-recommends \
-      ca-certificates gnupg bzip2 xz-utils curl jq gettext-base openssl \
+      ca-certificates gnupg gpgv bzip2 xz-utils curl jq gettext-base openssl \
     && rm -rf /var/lib/apt/lists/* \
     && addgroup --system --gid 10001 aptly \
     && adduser --system --uid 10001 --ingroup aptly --home /var/lib/aptly --disabled-password aptly \