From 8a22a8839bb764bb8a759b296190628e54a333a4 Mon Sep 17 00:00:00 2001
From: Seth Vargo <seth@sethvargo.com>
Date: Wed, 28 Oct 2026 12:59:49 -0400
Subject: [PATCH 1/2] Mark pinned toolchain and plugin repos reproducible

---
 helm/private/repositories.bzl | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/helm/private/repositories.bzl b/helm/private/repositories.bzl
index 6353343..6a59b41 100644
--- a/helm/private/repositories.bzl
+++ b/helm/private/repositories.bzl
@@ -61,7 +61,7 @@ def _helm_toolchain_repository_impl(repository_ctx):
         repository_ctx.name,
     ))
 
-    return {
+    attrs_for_reproducibility = {
         "integrity": results.integrity,
         "name": repository_ctx.name,
         "platform": repository_ctx.attr.platform,
@@ -70,6 +70,16 @@ def _helm_toolchain_repository_impl(repository_ctx):
         "urls": repository_ctx.attr.urls,
     }
 
+    # Bazel <8.3.0 lacks repository_ctx.repo_metadata
+    if not hasattr(repository_ctx, "repo_metadata"):
+        return attrs_for_reproducibility
+
+    reproducible = repository_ctx.attr.integrity != ""
+    return repository_ctx.repo_metadata(
+        reproducible = reproducible,
+        attrs_for_reproducibility = {} if reproducible else attrs_for_reproducibility,
+    )
+
 helm_toolchain_repository = repository_rule(
     implementation = _helm_toolchain_repository_impl,
     doc = "A repository rule for generating a Helm toolchain definition",
@@ -148,6 +158,12 @@ def _helm_plugin_repository_impl(repository_ctx):
         repository_ctx.name,
     ))
 
+    # Bazel <8.3.0 lacks repository_ctx.repo_metadata
+    if not hasattr(repository_ctx, "repo_metadata"):
+        return None
+
+    return repository_ctx.repo_metadata(reproducible = repository_ctx.attr.integrity != "")
+
 helm_plugin_repository = repository_rule(
     implementation = _helm_plugin_repository_impl,
     doc = "A repository rule for downloading a Helm plugin and generating a helm_plugin target.",
@@ -303,6 +319,12 @@ def _helm_toolchain_repository_hub_impl(repository_ctx):
         toolchain_type = str(repository_ctx.attr.toolchain_type),
     ))
 
+    # Bazel <8.3.0 lacks repository_ctx.repo_metadata
+    if not hasattr(repository_ctx, "repo_metadata"):
+        return None
+
+    return repository_ctx.repo_metadata(reproducible = True)
+
 helm_toolchain_repository_hub = repository_rule(
     doc = (
         "Generates a toolchain-bearing repository that declares a set of other toolchains from other " +

From 0fa21aa06996b183367bca9c03491d3ed2ef654b Mon Sep 17 00:00:00 2001
From: Seth Vargo <seth@sethvargo.com>
Date: Wed, 28 Oct 2026 14:09:08 -0400
Subject: [PATCH 2/2] Retrigger CI