Use internal proxies for Helm charts and PyPI packages

- Switch Helm chart dependencies to OCI-based internal registry
  (deps.global.bsf.tools/registry-1.docker.io-helmoci/bitnamicharts)
- Remove public helm repo adds (not needed for OCI)
- Add PIP_INDEX_URL to use internal PyPI proxy for all pip installs

This reduces dependencies on public internet during CI builds.

.gitlab-ci.yml

@@ -6,6 +6,8 @@ include:
 variables:
 # renovate: datasource=gitlab-tags depName=esv/bsf/pypi/prosper versioning=semver registryUrl=https://gitlab.global.bsf.tools
   PROSPER_VERSION: v0.64.1
+  # Use internal PyPI proxy instead of public internet
+  PIP_INDEX_URL: https://deps.global.bsf.tools/artifactory/api/pypi/pypi.org/simple
 
 # Prevent duplicate pipelines for MRs
 workflow:
@@ -184,11 +186,9 @@ frontend_tests:
 
 .helm_setup: &helm_setup
   - helm version
-  - helm repo add stable https://charts.helm.sh/stable
-  - helm repo add bitnami https://charts.bitnami.com/bitnami
   - cd helm/orchard
+  # OCI-based charts from internal registry - no repo add needed
   - helm dependency update
-  - helm repo update
 
 .verify_deployment: &verify_deployment |
   echo "=== Waiting for health endpoint (certs may take a few minutes) ==="

helm/orchard/Chart.yaml

@@ -17,13 +17,13 @@ maintainers:
 dependencies:
   - name: postgresql
     version: "15.5.x"
-    repository: https://charts.bitnami.com/bitnami
+    repository: oci://deps.global.bsf.tools/registry-1.docker.io-helmoci/bitnamicharts
     condition: postgresql.enabled
   - name: minio
     version: "14.x.x"
-    repository: https://charts.bitnami.com/bitnami
+    repository: oci://deps.global.bsf.tools/registry-1.docker.io-helmoci/bitnamicharts
     condition: minio.enabled
   - name: redis
     version: "19.x.x"
-    repository: https://charts.bitnami.com/bitnami
+    repository: oci://deps.global.bsf.tools/registry-1.docker.io-helmoci/bitnamicharts
     condition: redis.enabled