Switch CI to Red Hat Go and add godebug fips140=auto

Add godebug fips140=auto directive to go.mod for FIPS auto-detection
on RHEL systems. Replace actions/setup-go with the Red Hat Go container
image (ubi9/go-toolset:1.26) in all CI workflows, since upstream Go
does not recognize fips140=auto and panics at init.

Drop --user root from CI containers

Run as the container's default user (uid 1001) which matches the
GitHub Actions runner user. Fixes permission-based tests that fail
when running as root since root bypasses file permission checks.

Fix git safe.directory for container-based CI

Add safe.directory config step after checkout in all workflows to fix
"dubious ownership" errors when running as root inside the Red Hat Go
container while the workspace is owned by the runner user.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Martin Szuc <mszuc@redhat.com>

Author: martinszuc

.github/workflows/build-test.yml

@@ -16,16 +16,13 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
-      - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
+      - name: Mark workspace as safe directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Test source headers are present
         run: make test-source-headers
       - name: Check if go modules need to be tidied

.github/workflows/golangci-lint.yml

@@ -11,16 +11,15 @@ jobs:
   golangci:
     name: golangci-lint
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+      - name: Mark workspace as safe directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
       - name: golangci-lint
         uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #pin@9.2.1
         with:

.github/workflows/govulncheck.yml

@@ -17,18 +17,15 @@ jobs:
   govulncheck:
     name: govulncheck
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
         with:
           persist-credentials: false
-      - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
+      - name: Mark workspace as safe directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: govulncheck
         uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # pin@1.0.4
         with:

.github/workflows/release.yml

@@ -18,20 +18,15 @@ jobs:
   release:
     if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'helm/helm'
     runs-on: ubuntu-latest-16-cores
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
         with:
           fetch-depth: 0
-
-      - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
-
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
+      - name: Mark workspace as safe directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Run unit tests
         run: make test-coverage
       - name: Build Helm Binaries
@@ -83,20 +78,15 @@ jobs:
   canary-release:
     runs-on: ubuntu-latest-16-cores
     if: github.ref == 'refs/heads/main' && github.repository == 'helm/helm'
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
         with:
           fetch-depth: 0
-
-      - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
-
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
+      - name: Mark workspace as safe directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - name: Run unit tests
         run: make test-coverage

go.mod

@@ -2,6 +2,8 @@ module helm.sh/helm/v4
 
 go 1.26.0
 
+godebug fips140=auto
+
 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24
 	github.com/BurntSushi/toml v1.6.0