feat: bundle Deno binary into the operator image

Dockerfile

@@ -1,3 +1,5 @@
+ARG DENO_VERSION=2.9.4
+
 FROM golang:1.25 AS builder
 
 ARG TARGETOS
@@ -16,12 +18,17 @@ COPY internal/ internal/
 
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
 
-FROM gcr.io/distroless/static:nonroot
+FROM denoland/deno:bin-${DENO_VERSION} AS deno
+
+# Deno is dynamically linked against glibc, so the final image cannot be distroless/static.
+FROM gcr.io/distroless/cc-debian12:nonroot
 
-ENV HOME=/tmp
+ENV HOME=/tmp \
+    NELM_DENO_BINARY_PATH=/usr/local/bin/deno
 
 WORKDIR /
 
+COPY --from=deno /deno /usr/local/bin/deno
 COPY --from=builder /nelm-operator/manager .
 
 USER 65532:65532

Makefile

@@ -136,7 +136,8 @@ docker-push: ## Push docker image with the manager.
 # - have enabled BuildKit. More info: https://docs.docker.com/develop/develop-images/build_enhancements/
 # - be able to push the image to your registry (i.e. if you do not set a valid value via IMG=<myregistry/image:<tag>> then the export will fail)
 # To adequately provide solutions that are compatible with multiple platforms, you should consider using this option.
-PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
+# Limited to amd64/arm64: Deno, which the image bundles for TypeScript charts, publishes no other linux builds.
+PLATFORMS ?= linux/arm64,linux/amd64
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
 	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile

cmd/main.go

@@ -48,8 +48,8 @@
 	var dependencyWatchLabelSelector string
 
 	// Controller runtime flags.
 	flag.StringVar(&cfg.MetricsBindAddress, "metrics-bind-address", "0", "The address the metrics endpoint binds to. Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable.")
 	flag.StringVar(&cfg.HealthProbeBindAddress, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
 	flag.BoolVar(&cfg.LeaderElect, "leader-elect", false, "Enable leader election for controller manager.")
 	flag.BoolVar(&cfg.MetricsSecure, "metrics-secure", true, "If set, the metrics endpoint is served securely via HTTPS.")
 	flag.StringVar(&metricsCertDir, "metrics-cert-path", "", "The directory that contains the metrics server certificate.")
@@ -57,8 +57,8 @@
 	flag.StringVar(&metricsCertKey, "metrics-cert-key", "tls.key", "The name of the metrics server key file.")
 
 	// Operator-specific flags.
 	flag.StringVar(&cfg.DefaultServiceAccountName, "default-service-account", "", "Service account to use during release deploy.")
 	flag.IntVar(&cfg.MaxConcurrentReconciles, "max-concurrent-reconciles", 5, "Number of Release CRDs reconciled in parallel.")
 	flag.DurationVar(&cfg.GracefulShutdownTimeout, "graceful-shutdown-timeout", 600*time.Second, "How long to wait for in-flight reconciles on SIGTERM.")
 	flag.BoolVar(&cfg.WatchAllNamespaces, "watch-all-namespaces", true, "Watch Release CRDs in all namespaces.")
 	flag.StringVar(&cfg.WatchNamespace, "watch-namespace", "", "If set, only watch this namespace for Release CRDs.")
@@ -82,7 +82,7 @@
 	flag.IntVar(&cfg.NetworkParallelism, "network-parallelism", 30, "Limit of network-related tasks to run in parallel per reconcile.")
 
 	// TypeScript / Misc.
-	flag.StringVar(&cfg.DenoBinaryPath, "deno-binary-path", "", "Path to the Deno binary for TypeScript chart rendering.")
+	flag.StringVar(&cfg.DenoBinaryPath, "deno-binary-path", "", "Path to the Deno binary for TypeScript chart rendering. Falls back to $NELM_DENO_BINARY_PATH, then to downloading Deno at runtime.")
 	flag.StringVar(&cfg.TempDir, "temp-dir", "", "Directory for temporary files.")
 
 	// Logging.
@@ -117,6 +117,10 @@
 		cfg.ReleaseStorageSQLConnection = v
 	}
 
+	if v := os.Getenv("NELM_DENO_BINARY_PATH"); v != "" && cfg.DenoBinaryPath == "" {
+		cfg.DenoBinaryPath = v
+	}
+
 	cfg.MetricsCertDir = metricsCertDir
 	cfg.MetricsCertName = metricsCertName
 	cfg.MetricsCertKey = metricsCertKey