ci: sign the published Helm charts with cosign (keyless)

The image already carried provenance + SBOM attestations while the charts were
pushed bare, so nothing about a published chart was verifiable. Sign them in the
release workflow with keyless cosign: the signature is bound to this workflow's
GitHub OIDC identity via a short-lived Fulcio certificate, so there is no
long-lived key to store or rotate.

Charts are signed BY DIGEST (parsed out of `helm push`), so a signature binds to
that exact artifact and cannot be voided by someone later moving the tag. The
digest parse is guarded: an unparseable `helm push` output fails the job rather
than silently skipping the signature.

Note this does NOT fix the Artifact Hub "429 Too Many Requests" alert. That comes
from ghcr's OCI referrers endpoint, which 303-redirects to a legacy GitHub
packages URL with the digest truncated at the colon; it 404s or rate-limits
regardless of whether a signature exists. This is about the charts actually being
verifiable, not about silencing that probe.

Author: melancholictheory

.github/workflows/release.yml

@@ -76,6 +76,10 @@ jobs:
     permissions:
       contents: read
       packages: write
+      # Keyless signing trades this OIDC token for a short-lived Fulcio
+      # certificate: the signature is bound to this workflow's identity, so
+      # there is no long-lived private key to store or rotate.
+      id-token: write
     steps:
       - name: Clone the code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -85,15 +89,39 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
       - name: Log in to the Container registry
         run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login "${REGISTRY}" --username "${{ github.actor }}" --password-stdin
 
-      - name: Package and push charts
+      # cosign authenticates through the Docker config, which `helm registry
+      # login` does not write — so log in again the Docker way for the push of
+      # the signature itself.
+      - name: Log in to the Container registry (for cosign)
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Package, push and sign charts
         run: |
           version="${GITHUB_REF_NAME#v}"
           for chart in charts/valkey-operator charts/valkey-cluster; do
             helm package "$chart" --version "$version" --app-version "$version"
           done
           for pkg in *.tgz; do
-            helm push "$pkg" "oci://${REGISTRY}/${{ github.repository_owner }}/charts"
+            # `helm push` reports the pushed ref and its digest. Sign BY DIGEST so
+            # the signature binds to that exact artifact and cannot be voided by
+            # someone later moving the tag.
+            out=$(helm push "$pkg" "oci://${REGISTRY}/${{ github.repository_owner }}/charts" 2>&1)
+            echo "$out"
+            ref=$(printf '%s\n' "$out" | awk '/Pushed:/{print $2}')
+            digest=$(printf '%s\n' "$out" | awk '/Digest:/{print $2}')
+            if [ -z "$ref" ] || [ -z "$digest" ]; then
+              echo "could not parse ref/digest out of helm push output for $pkg" >&2
+              exit 1
+            fi
+            cosign sign --yes "${ref%:*}@${digest}"
           done

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project aims to
 follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+- The published Helm charts are now signed with cosign, keyless, using the
+  release workflow's own GitHub OIDC identity, so there is no private key to
+  store or rotate. Charts are signed **by digest**, so a signature binds to that
+  exact artifact and cannot be voided by moving a tag. Verify one with:
+
+  ```sh
+  cosign verify ghcr.io/melancholictheory/charts/valkey-operator:<version> \
+    --certificate-identity-regexp '^https://github\.com/melancholictheory/wellcake/\.github/workflows/release\.yml@' \
+    --certificate-oidc-issuer https://token.actions.githubusercontent.com
+  ```
+
 ## [0.5.0]
 
 Data-plane telemetry and resilience work built on Valkey 9.1+. Every directive is