Strip sha256 hash

Dockerfile

@@ -1,11 +1,11 @@
-FROM golang:1.26-bookworm@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514 AS build
+FROM golang:1.26-bookworm AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -trimpath -ldflags="-s -w" -o /manager ./cmd/manager
 
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
+FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /manager /manager
 USER 65532:65532
 ENTRYPOINT ["/manager"]

hack/install-helm.sh

@@ -5,19 +5,10 @@ set -euo pipefail
 : "${RUNNER_TEMP:?RUNNER_TEMP must be set}"
 
 archive="helm-${HELM_VERSION}-linux-amd64.tar.gz"
-checksum="${archive}.sha256sum"
 
 curl --fail --silent --show-error --location \
   --output "${RUNNER_TEMP}/${archive}" \
   "https://get.helm.sh/${archive}"
-curl --fail --silent --show-error --location \
-  --output "${RUNNER_TEMP}/${checksum}" \
-  "https://get.helm.sh/${checksum}"
-
-# The upstream checksum contains the upstream archive basename, so preserve
-# that basename and perform the check from its containing directory.
-(cd "${RUNNER_TEMP}" && sha256sum --check "${checksum}")
-
 tar --extract --gzip --file "${RUNNER_TEMP}/${archive}" \
   --directory "${RUNNER_TEMP}" linux-amd64/helm
 mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"