Switch CI to Red Hat Go and add godebug fips140=auto

Add godebug fips140=auto directive to go.mod for FIPS auto-detection
on RHEL systems. Replace actions/setup-go with the Red Hat Go container
image (ubi9/go-toolset:1.26) in all CI workflows, since upstream Go
does not recognize fips140=auto and panics at init.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Martin Szuc <mszuc@redhat.com>

Author: martinszuc

.github/workflows/build-test.yml

@@ -16,16 +16,12 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
+      options: --user root
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
-      - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
       - name: Test source headers are present
         run: make test-source-headers
       - name: Check if go modules need to be tidied

.github/workflows/golangci-lint.yml

@@ -11,16 +11,14 @@ jobs:
   golangci:
     name: golangci-lint
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
+      options: --user root
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
       - name: golangci-lint
         uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #pin@9.2.1
         with:

.github/workflows/govulncheck.yml

@@ -17,18 +17,14 @@ jobs:
   govulncheck:
     name: govulncheck
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
+      options: --user root
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
         with:
           persist-credentials: false
-      - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
       - name: govulncheck
         uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # pin@1.0.4
         with:

.github/workflows/release.yml

@@ -18,20 +18,14 @@ jobs:
   release:
     if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'helm/helm'
     runs-on: ubuntu-latest-16-cores
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
+      options: --user root
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
         with:
           fetch-depth: 0
-
-      - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
-
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
       - name: Run unit tests
         run: make test-coverage
       - name: Build Helm Binaries
@@ -83,21 +77,15 @@ jobs:
   canary-release:
     runs-on: ubuntu-latest-16-cores
     if: github.ref == 'refs/heads/main' && github.repository == 'helm/helm'
+    container:
+      image: registry.access.redhat.com/ubi9/go-toolset:1.26
+      options: --user root
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
         with:
           fetch-depth: 0
 
-      - name: Add variables to environment file
-        run: cat ".github/env" >> "$GITHUB_ENV"
-
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # pin@6.4.0
-        with:
-          go-version: '${{ env.GOLANG_VERSION }}'
-          check-latest: true
-
       - name: Run unit tests
         run: make test-coverage
 

go.mod

@@ -2,6 +2,8 @@ module helm.sh/helm/v4
 
 go 1.26.0
 
+godebug fips140=auto
+
 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24
 	github.com/BurntSushi/toml v1.6.0