DND-1418: don't vendor the comet-common subchart; resolve it in CI

Git-ignore charts/s3proxy/charts/ and stop checking in the resolved
comet-common-0.3.0.tgz. Chart.lock (committed) pins the version/digest, and each
workflow that renders, installs, or packages the chart now runs
`helm dependency build charts/s3proxy` first. comet-common's OCI package is
anonymously pullable, so this needs no registry auth and still works on fork PRs.

- .gitignore: ignore charts/s3proxy/charts/.
- lint-render / functional-test / release: add a "Build chart dependencies" step
  after Set up Helm (release also gains a Set up Helm step).
- helm-diff: build deps for whichever side (base/head) has a Chart.lock before
  rendering (base may predate the dependency).

Verified: removing the local .tgz and running `helm dependency build` from
Chart.lock repopulates it and the chart renders; actionlint clean on the changed
render/install workflows; helm-polish clean.

Author: CRThaze

.github/workflows/functional-test.yaml

@@ -71,6 +71,11 @@ jobs:
         with:
           version: v3.19.2
 
+      - name: Build chart dependencies
+        # comet-common is not vendored in-repo; resolve it from Chart.lock
+        # (anonymous OCI pull, no auth needed).
+        run: helm dependency build charts/s3proxy
+
       - name: Create kind cluster
         uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
 

.github/workflows/helm-diff.yaml

@@ -48,6 +48,18 @@ jobs:
         with:
           version: v3.19.2
 
+      - name: Build chart dependencies
+        # comet-common is not vendored in-repo; resolve it from Chart.lock on each
+        # side that has one (base may predate the dependency), before rendering.
+        run: |
+          for dir in base-repo pr-repo
+          do
+            if [ -f "${dir}/${CHART_PATH}/Chart.lock" ]
+            then
+              helm dependency build "${dir}/${CHART_PATH}"
+            fi
+          done
+
       - name: Render and diff
         run: |
           set -uo pipefail

.github/workflows/lint-render.yaml

@@ -45,6 +45,11 @@ jobs:
         with:
           version: v3.19.2
 
+      - name: Build chart dependencies
+        # comet-common is not vendored in-repo; resolve it from Chart.lock
+        # (anonymous OCI pull, no auth needed).
+        run: helm dependency build charts/s3proxy
+
       - name: Helm lint
         run: helm lint charts/s3proxy --values "${{ matrix.values }}"
 

.github/workflows/release.yaml

@@ -81,6 +81,16 @@ jobs:
         run: |
           cp README.md charts/s3proxy/
 
+      - name: Set up Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: v3.19.2
+
+      - name: Build chart dependencies
+        # comet-common is not vendored in-repo; resolve it from Chart.lock
+        # (anonymous OCI pull) so chart-releaser can package the chart.
+        run: helm dependency build charts/s3proxy
+
       - name: Run chart-releaser
         uses: bitdeps/helm-oci-charts-releaser@v0.1.3
         with:

.gitignore

@@ -0,0 +1,3 @@
+# Vendored Helm chart dependencies. Not checked in; resolved from Chart.lock via
+# `helm dependency build` (CI does this before lint/template/install/package).
+charts/s3proxy/charts/

charts/s3proxy/Chart.yaml

@@ -24,8 +24,10 @@ version: 0.2.0
 appVersion: "3.3.0"
 
 # comet-common is a library chart of shared helpers (names, labels, images, ...)
-# used across Comet charts. Vendored in-repo (charts/*.tgz + Chart.lock) so CI and
-# fork PRs resolve it without registry access.
+# used across Comet charts. The resolved dependency (charts/*.tgz) is git-ignored,
+# not checked in; Chart.lock pins the version/digest and CI runs
+# `helm dependency build` (anonymous OCI pull, no auth) before lint/template/
+# install/package.
 dependencies:
   - name: comet-common
     version: "0.3.0"