fix(build): vendor Helm Go deps for hermetic Konflux builds

.github/workflows/pr-build.yaml

@@ -47,15 +47,19 @@ jobs:
             **/*.adoc
             examples/**
 
-      - name: List all changed files (for troubleshooting)
+      - name: Summarize changed files (for troubleshooting)
         if: steps.changed-files.outputs.any_changed == 'true'
         env:
-          ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+          CHANGED_COUNT: ${{ steps.changed-files.outputs.all_changed_files_count }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          # Use printf and quoted variables to prevent word splitting/execution
-          printf '%s\n' "$ALL_CHANGED_FILES" | while IFS= read -r file; do
-            echo "Changed: $file"
-          done
+          echo "Changed files matching build paths: ${CHANGED_COUNT}"
+          # Avoid passing the full file list via env (ARG_MAX); show a small sample only.
+          git diff --name-only "${BASE_SHA}" "${HEAD_SHA}" | head -20
+          if [ "${CHANGED_COUNT}" -gt 20 ]; then
+            echo "... and $(( CHANGED_COUNT - 20 )) more"
+          fi
 
       # Generate image tags and build args
       - name: Prepare build variables

.rhdh/docker/Containerfile

@@ -43,7 +43,7 @@ WORKDIR /opt/app-root/src/helm
 RUN set -eu; \
     . /cachi2/cachi2.env; \
     HELM_VERSION=$(grep '^HELM_VERSION' /tmp/Makefile | sed 's/.*:= *//'); \
-    CGO_ENABLED=0 go build -trimpath \
+    CGO_ENABLED=0 go build -mod=vendor -trimpath \
         -ldflags "-X helm.sh/helm/v4/internal/version.version=v${HELM_VERSION}" \
         -o /tmp/helm ./cmd/helm && \
     /tmp/helm version

Containerfile

@@ -20,7 +20,7 @@ COPY Makefile /tmp/Makefile
 COPY vendor/helm /opt/app-root/src/helm
 WORKDIR /opt/app-root/src/helm
 RUN HELM_VERSION=$(grep '^HELM_VERSION' /tmp/Makefile | sed 's/.*:= *//') && \
-    CGO_ENABLED=0 go build -trimpath \
+    CGO_ENABLED=0 go build -mod=vendor -trimpath \
         -ldflags "-X helm.sh/helm/v4/internal/version.version=v${HELM_VERSION}" \
         -o /tmp/helm ./cmd/helm && \
     /tmp/helm version

hack/update-vendor.sh

@@ -85,6 +85,21 @@ prune_helm() {
     find "$dir" -type d -name testdata -exec rm -rf {} +
 }
 
+finalize_helm() {
+    local dir="$1"
+
+    if ! command -v go &>/dev/null; then
+        echo "Error: go is required to vendor Helm module dependencies"
+        exit 1
+    fi
+
+    # Drop test-only requires and vendor external modules for hermetic (cachi2) builds.
+    (cd "$dir" && go mod tidy && go mod vendor)
+
+    # Verify the pruned tree still builds offline with vendored deps.
+    (cd "$dir" && CGO_ENABLED=0 go build -mod=vendor -trimpath -o /dev/null ./cmd/helm)
+}
+
 prune_websocat() {
     local dir="$1"
 
@@ -103,7 +118,10 @@ prune_websocat() {
 }
 
 case "$NAME" in
-    helm)     prune_helm "$PREFIX" ;;
+    helm)
+        prune_helm "$PREFIX"
+        finalize_helm "$PREFIX"
+        ;;
     websocat) prune_websocat "$PREFIX" ;;
 esac