From d1fa115a6c0c44d9a188264818d70182e28a2444 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Wed, 12 Mar 2025 05:40:55 -0400 Subject: [PATCH] ci(helm): cosign OCI helm chart (#852) * ci(helm): cosign OCI helm chart This allows for the OCI Helm chart to be verified on our end using keyless verification. You can read more about it https://fluxcd.io/blog/2022/11/verify-the-integrity-of-the-helm-charts-stored-as-oci-artifacts-before-reconciling-them-with-flux/ * Update push-helm-chart.yaml * Update push-helm-chart.yaml --- .github/workflows/push-helm-chart.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/push-helm-chart.yaml b/.github/workflows/push-helm-chart.yaml index aaea95d3..e6d8c5d6 100644 --- a/.github/workflows/push-helm-chart.yaml +++ b/.github/workflows/push-helm-chart.yaml @@ -21,7 +21,8 @@ jobs: permissions: contents: read - packages: write # to push artifacts to `ghcr.io` + id-token: write # needed for signing the images with GitHub OIDC Token + packages: write # for pushing and signing container images name: Verify and Push Helm Chart if: ${{ (github.event.pull_request.merged == true) && (contains(github.event.pull_request.labels.*.name, 'release/helm-chart')) }} @@ -70,6 +71,9 @@ jobs: echo "Helm Chart Version wasnt updated" exit 1 + - name: Install Cosign + uses: sigstore/cosign-installer@v3.8.1 + - name: Login to GHCR Registry uses: docker/login-action@v3 with: @@ -83,6 +87,9 @@ jobs: helm push ./packaged-chart/*.tgz oci://ghcr.io/stakater/charts rm -rf ./packaged-chart + - name: Sign artifacts with Cosign + run: cosign sign --yes ghcr.io/stakater/charts/reloader:${{ steps.new_chart_version.outputs.result }} + - name: Publish Helm chart to gh-pages uses: stefanprodan/helm-gh-pages@master with: