Secrets 一元管理チャート secret-manager v0.1.0 を実装

クラスター横断で使う認証情報を1チャートで管理し、複数ネームスペースへ
同一 Secret として配布する仕組みを実装。

- distribution: namespaces への複製 / kubernetes-reflector 自動同期 /
  stakater-Reloader 連携を選択可能
- common: namePrefix・共通ラベル/アノテーション・immutable
- mail.providers: SMTP/IMAP/POP3 のサーバ情報 + パスワードを一元管理。
  source 可能な smtp.env と任意の msmtprc スニペットを Secret に同梱
- api.credentials: 任意のキー/値集合を Opaque Secret 化（envFrom 向け）
- generic.secrets: 任意 type（dockerconfigjson / tls / basic-auth 等）
- values.schema.json による厳格バリデーション
- examples/（Gmail・M365・SendGrid・SES・Mailgun・reflector）
- .gitea/workflows/helm-release.yaml で Package Registry へ自動発行
- README.md にセキュリティモデル・values リファレンス・参照方法を記載
- 平文資格情報の混入防止に .gitignore を整備

.gitea/workflows/helm-release.yaml

@@ -0,0 +1,106 @@
+# .gitea/workflows/helm-release.yaml
+# 汎用Helmチャート公開ワークフロー（全リポジトリ共通）
+
+name: Helm Chart Release
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  workflow_dispatch:
+
+env:
+  REGISTRY_URL: https://git.cafepieters.com
+  OWNER: helmchart
+
+jobs:
+  release-chart:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        run: |
+          echo "🔄 Cloning repository..."
+          git clone --depth 1 $GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git .
+          echo "✅ Repository cloned"
+
+      - name: Install Helm
+        run: |
+          echo "📦 Installing Helm..."
+          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+          helm version
+          echo "✅ Helm installed"
+
+      - name: Get Chart Info
+        id: chart_info
+        run: |
+          # Chart.yamlからチャート名とバージョンを取得
+          CHART_NAME=$(grep '^name:' Chart.yaml | awk '{print $2}')
+          CHART_VERSION=$(grep '^version:' Chart.yaml | awk '{print $2}')
+          
+          echo "Chart Name: ${CHART_NAME}"
+          echo "Chart Version: ${CHART_VERSION}"
+          
+          # GitHub Actionsの環境変数として設定
+          echo "CHART_NAME=${CHART_NAME}" >> $GITHUB_ENV
+          echo "CHART_VERSION=${CHART_VERSION}" >> $GITHUB_ENV
+
+      - name: Validate Chart
+        run: |
+          echo "🔍 Validating Helm chart..."
+          helm lint .
+          echo "✅ Chart validation passed"
+
+      - name: Package Chart
+        run: |
+          echo "📦 Packaging Helm chart..."
+          helm package .
+          
+          CHART_FILE=$(ls *.tgz)
+          echo "✅ Packaged: ${CHART_FILE}"
+          echo "CHART_FILE=${CHART_FILE}" >> $GITHUB_ENV
+
+      - name: Publish to Gitea Package Registry
+        run: |
+          echo "🚀 Publishing ${CHART_FILE} to Gitea Package Registry..."
+          
+          curl --fail-with-body \
+            -u "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_TOKEN }}" \
+            -X POST \
+            --upload-file "${CHART_FILE}" \
+            "${REGISTRY_URL}/api/packages/${OWNER}/helm/api/charts"
+          
+          echo "✅ Chart published successfully!"
+
+      - name: Summary
+        if: success()
+        run: |
+          echo "================================"
+          echo "✅ Deployment Successful!"
+          echo "================================"
+          echo "Repository: ${{ github.repository }}"
+          echo "Chart Name: ${CHART_NAME}"
+          echo "Chart Version: ${CHART_VERSION}"
+          echo "Chart File: ${CHART_FILE}"
+          echo "Branch: ${{ github.ref }}"
+          echo "Commit: ${{ github.sha }}"
+          echo "================================"
+          echo ""
+          echo "📦 Install with:"
+          echo "helm repo add cafepieters ${REGISTRY_URL}/api/packages/${OWNER}/helm"
+          echo "helm repo update"
+          echo "helm install my-${CHART_NAME} cafepieters/${CHART_NAME}"
+
+      - name: Error Report
+        if: failure()
+        run: |
+          echo "================================"
+          echo "❌ Deployment Failed!"
+          echo "================================"
+          echo "Check the logs above for details"
+          echo "Common issues:"
+          echo "- Missing Chart.yaml"
+          echo "- Invalid Helm chart structure"
+          echo "- Missing REGISTRY_USER or REGISTRY_TOKEN secrets"
+          echo "- Insufficient permissions on Personal Access Token"
+          echo "================================"