ci(helm): cosign OCI helm chart (#852)

* ci(helm): cosign OCI helm chart

This allows for the OCI Helm chart to be verified on our end using keyless verification.

You can read more about it https://fluxcd.io/blog/2022/11/verify-the-integrity-of-the-helm-charts-stored-as-oci-artifacts-before-reconciling-them-with-flux/

* Update push-helm-chart.yaml

* Update push-helm-chart.yaml

.github/workflows/push-helm-chart.yaml

@@ -21,7 +21,8 @@ jobs:
 
     permissions:
       contents: read
-      packages: write # to push artifacts to `ghcr.io`
+      id-token: write # needed for signing the images with GitHub OIDC Token
+      packages: write # for pushing and signing container images
 
     name: Verify and Push Helm Chart
     if: ${{ (github.event.pull_request.merged == true) && (contains(github.event.pull_request.labels.*.name, 'release/helm-chart')) }}
@@ -70,6 +71,9 @@ jobs:
           echo "Helm Chart Version wasnt updated"
           exit 1
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3.8.1
+
       - name: Login to GHCR Registry
         uses: docker/login-action@v3
         with:
@@ -83,6 +87,9 @@ jobs:
           helm push ./packaged-chart/*.tgz oci://ghcr.io/stakater/charts
           rm -rf ./packaged-chart
 
+      - name: Sign artifacts with Cosign
+        run: cosign sign --yes ghcr.io/stakater/charts/reloader:${{ steps.new_chart_version.outputs.result }}
+
       - name: Publish Helm chart to gh-pages
         uses: stefanprodan/helm-gh-pages@master
         with: