Fix pullpreview enterprise token injection

[crohr]

Summary

This refactors the PullPreview workflows to stop transporting the OpenProject enterprise token through chart_set and instead render it through a checked-in Helm values template. The dispatch and scheduled workflows now share a single pullpreview/stack-values.yaml.gotmpl file, and the dispatch workflow passes only its optional override values as environment variables into the PullPreview action.

Root Cause

The original setup relied on chart_set to carry the enterprise token into the preview deployment. In PullPreview, chart_set is parsed as a comma-separated list and then translated into Helm --set arguments, which is a bad transport for a large opaque token payload.

The chart already supports seeding OPENPROJECT_SEED__ENTERPRISE__TOKEN through the generated OpenProject environment secret, so the safer path is to render that value into a Helm values file and let the chart consume it normally.

What Changed

• Pinned pullpreview/action to 65df5209b58f360444525f1167f9e14803521fed, which includes local *.gotmpl rendering support for chart_values and the rebuilt dist bundle.
• Replaced the old generated dispatch values flow with one checked-in template: pullpreview/stack-values.yaml.gotmpl.
• Moved the enterprise token into openproject.environment.OPENPROJECT_SEED__ENTERPRISE__TOKEN inside that shared template.
• Removed chart_set token injection entirely.
• Removed the separate token overlay and dispatch-generated values file in favor of the single shared template.
• Kept the dispatch workflow inputs unchanged, but mapped them to plain internal env names like OPENPROJECT_VERSION and INTEGRATION_OPENPROJECT_VERSION instead of INPUT_* names.
• Kept the scheduled PullPreview workflow on the same shared template, with default behavior when override env vars are absent.
• Preserved the job-summary secondary URLs step in the scheduled PullPreview workflow.

Validation

• Parsed .github/workflows/pullpreview.yml and .github/workflows/pullpreview-dispatch.yml successfully after each refactor step.
• Verified there are no remaining INPUT_ references in the workflow/template path.
• Reviewed the final diff against main; no code-level regression stood out in the current branch.

Follow-up Validation

• Run one scheduled PullPreview deployment.
• Run one pullpreview-dispatch.yml deployment from openproject-e2e.
• Confirm OpenProject comes up licensed without manual token application.

[github-actions]

Deploying integration-qa-helmfile with ⚡ PullPreview

Field	Value
Latest commit	a225f7b
Job	deploy
Status	🗑️ Preview destroyed
Preview URL	Destroyed

View logs