[rushtong]

Addresses

https://broadworkbench.atlassian.net/browse/DT-4348

Stacked PRs (merge in order):

1. [DT-4348][risk=no] Render the local certs with render-configs.sh (1/5) #3177 Base and certs
2. [DT-4348][risk=no] Render consent.yaml, site.conf and oauth2.conf from terra-helmfile (2/5) #3178 Chart configs ← this PR
3. [DT-4348][risk=no] Render the local compose files and .env (3/5) #3179 Compose
4. [DT-4348][risk=no] Export the dev database and fill the local index (4/5) #3180 Dump and index
5. [DT-4348][risk=no] Render the local config in the Dev Container (5/5) #3181 Dev Container

Summary

Renders consent.yaml, site.conf and oauth2.conf from the consent chart in terra-helmfile, with helm template. The rendered files are the reference for local config. See "Chart Configs" in the plan.

• scripts/render-chart-configs.sh: clones terra-helmfile (or uses --helmfile_dir), builds the chart dependencies in a temp copy, renders the helmfile values templates, and runs helm template with the dev values in helmfile order. It fails if {{ remains in any output, and it never changes a local checkout. It runs on its own without the VPN.
• scripts/templates/local-values.yaml: the only local value changes: elasticSearchServers and replicas. The script refuses key names that look like secrets.
• render-configs.sh: adds --write_chart_configs, --helmfile_ref and --helmfile_dir.
• clone_helmfile in common.sh: git clone over HTTPS, then SSH, with GIT_TERMINAL_PROMPT=0, the same as duos-ui render-site-conf.sh.
• DEVNOTES.md: removes the "Configure" section, which told developers to copy consent-config.yml by hand, and adds a "Liquibase" note: the rendered consent.yaml has no liquibase block.

Testing

• Rendered from terra-helmfile master (ee48cb6) with helm 4.2.3 over HTTPS, without the VPN, through both scripts.
• Two renders give the same files.
• Not tested: an SSH-only git setup.

---

Have you read CONTRIBUTING.md lately? If not, do that first.

• Label PR with a Jira ticket number and include a link to the ticket
• Label PR with a security risk modifier [no, low, medium, high]
• PR describes scope of changes
• Get a minimum of one thumbs worth of review, preferably two if enough team members are available
• Get PO sign-off for all non-trivial UI or workflow changes
• Verify all tests go green
• Test this change deployed correctly and works on dev environment after deployment

🤖 Generated with Claude Code