Replace hardcoded secrets with auto-generated secrets and add validation pipeline

[Copilot]

This PR replaces all hardcoded secrets in the Matrix Synapse Helm chart with auto-generated secrets that are preserved across upgrades, and adds a comprehensive validation pipeline to ensure chart quality and security.

Problem

The chart contained several hardcoded secrets that posed security risks:

• macaroon_secret_key: uLJ62kwNWO_DLcKAmbzqYkFwlDQWjNl5@G#SKT*i9~bZrZy~_@
• form_secret: 2iTjom-bIq5Yh6:afKjUed^2Eokx8cd_kzdUN,A#0MFAn.tSrC
• client_secret for OIDC: uLJ62kwNWO_DLcKAmbzqYkFwlDQWjNl5@G#SKT*i9~bZrZy~_@
• coturn.sharedSecret: "ChangeMe"

Solution

Implemented a comprehensive secret management system using Helm's lookup function and added automated validation:

Secret Management

1. Auto-generation at deployment: Secrets are generated using randAlphaNum (64 characters for most secrets, 32 for coturn)
2. Upgrade preservation: Uses lookup to check for existing secrets and preserves them during upgrades
3. Secure storage: All secrets are base64 encoded and stored in Kubernetes Secret resources

Validation Pipeline

Added comprehensive validation workflows including:

GitHub Actions Workflows:

• Helm chart validation (lint, template rendering, manifest validation)
• Security scanning with Kubesec
• Chart testing with ct (chart-testing) and Kind clusters
• Release automation pipeline

Local Development Tools:

• Makefile with validation targets (make validate, make test, make ci)
• Automated detection of hardcoded secrets
• Secret auto-generation verification
• Local testing and packaging commands

Changes Made

Enhanced matrix-secret.yaml

• Fixed typo: macook_secret_key → macaroonSecretKey
• Added missing secrets: formSecret, clientSecret, coturnSharedSecret
• Implemented lookup logic to preserve existing secrets on upgrades

Updated homeserver template in _helpers.tpl

• Replaced all hardcoded secrets with references to generated secrets
• Added proper nil checks and fallback generation
• Secrets are decoded from base64 and injected into configuration

Modified values.yaml

• Removed hardcoded coturn.sharedSecret: "ChangeMe"
• Updated documentation to reflect auto-generation approach

Added Validation Infrastructure

• GitHub Actions workflows for CI/CD validation
• Local Makefile for development workflow
• Chart testing configuration
• Security scanning integration
• Updated documentation with validation instructions

Security Benefits

• Eliminates static secrets from version control
• Each deployment gets unique, cryptographically random secrets
• No service disruption during upgrades (secrets are preserved)
• Follows Kubernetes security best practices
• Automated security scanning in CI/CD pipeline
• Comprehensive validation ensures no hardcoded secrets remain

Testing

• All hardcoded secrets successfully eliminated from generated templates
• Helm lint validation passes
• Template generation produces unique secrets on each run
• RBAC permissions configured for secret lookup functionality
• Comprehensive CI/CD validation pipeline validates chart quality
• Local development workflow supports iterative testing

Fixes #3.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[nielsweistra]

@copilot also add a pipeline for the validaytion steps

[Copilot]

@copilot also add a pipeline for the validaytion steps

I've added a comprehensive validation pipeline for the Helm chart. The pipeline includes:

GitHub Actions Workflows:

• Helm chart validation (lint, template rendering, manifest validation)
• Security scanning with Kubesec
• Chart testing with ct and Kind clusters
• Release automation

Local Development:

• Makefile with validation targets (make validate, make test, make ci)
• Automated hardcoded secret detection
• Secret auto-generation verification

Key validation features:

• Verifies no hardcoded secrets remain in templates
• Ensures proper secret auto-generation and uniqueness
• Validates Kubernetes manifest syntax
• Security scanning of generated resources
• Documentation and local development workflow

All validation steps are now automated and will run on every PR and push. The commit is 7c27ed9.