security(supply-chain): cosign-sign the published Helm chart so the platform can verify it

[devantler]

🤖 Generated by the Agentic Engineer

Part of devantler-tech/platform#3558.

Evidence

.github/workflows/publish-chart.yaml packages the chart and runs helm push … oci://ghcr.io/devantler-tech/charts with packages: write only — no id-token: write, no cosign sign. The platform consumes it through k8s/bases/apps/data-product-controller/oci-repository.yaml, which is the only oci://ghcr.io/devantler-tech/* OCIRepository in the platform tree without spec.verify (the four manifests sources all verify against the shared publish workflow's keyless identity). It is pinned by content digest, so the installed chart cannot silently change — but nothing proves who produced that digest, and the pin has to be edited by hand for every release.

Audience and impact

platform#3558 wants CI to require cosign verification on every devantler-tech OCIRepository, discovered by kind and URL. As published today this chart cannot satisfy that: adding spec.verify would make Flux refuse it. So either the guard carries a standing exception for this one source, or the chart is signed — and signing is the reducible fix.

Expected

After helm push, the workflow signs the pushed chart digest keylessly (cosign sign --yes ghcr.io/devantler-tech/charts/data-product-controller@sha256:…, with id-token: write), so the OIDC subject is this workflow's path at the tagged ref. The platform side then adds spec.verify with that identity and can drop the hand-maintained digest pin in favour of a semver ref.

Acceptance criteria

• A tagged release publishes a chart whose digest has a cosign signature in GHCR (cosign verify with the workflow identity succeeds; read back, not inferred from the YAML).
• The signing identity (issuer + subject) is recorded in the platform OCIRepository's spec.verify.matchOIDCIdentity in a follow-up platform PR, and Flux reports the source Ready with verification.
• helm push and signing happen in the same job on the same digest, so a re-tag cannot sign a different artifact.

Rough size: S.

---

Blocker: devantler-tech/platform#3475 | upstream | last-verified 2026-09-16: the component is still staged off, so criterion 2's Flux-readiness half is not observable yet. k8s/bases/apps/kustomization.yaml keeps # - data-product-controller/ commented out, and the production cluster has no data-product-controller OCIRepository (the five OCIRepositories that do exist all report Ready with cosign verification). Activation is gated on platform#3498, which is OPEN; the other gate, platform#3497, closed 2026-09-02.

Criteria 1 and 3 are met and evidenced at immutable artifacts, and the consuming spec.verify identity landed in platform#3787. The residual is the runtime readiness half of criterion 2, which becomes observable once the activation program above enables the component.

[devantler]

🤖 Generated by the Agentic Engineer

The chart publisher repair merged in #39 as 8d1f4fb. Real publication is now verified: v1.0.3's Publish Helm chart run completed successfully at that merge commit.

The Helm push returned sha256:0e67de403470d578feeb4093e9618759d8fe520ba03c547d1cbf0777ccbfbc18; Cosign then signed and verified that same digest-qualified GHCR chart. The job's verification succeeded with the tagged workflow identity https://github.com/devantler-tech/data-product-controller/.github/workflows/publish-chart.yaml@refs/tags/v1.0.3 and GitHub Actions OIDC issuer.

Publisher signing and real release readback are complete. This issue remains open for the platform's verification/enforcement acceptance; no live cluster or platform deployment policy was changed in this work.

[devantler]

🤖 Generated by the Agentic Engineer

Signed release and platform verification are now joined

The publication half remains complete, and the consuming side has now landed too:

• I re-verified the immutable chart ghcr.io/devantler-tech/charts/data-product-controller@sha256:7c56cddf4d7dc25c6bc8bbc8c5b0cf461098537c84efc0406b276921d656acc5 with Cosign. Verification succeeded against GitHub Actions OIDC and the release-tagged publish-chart.yaml workflow identity.
• feat(security): verify the data-product-controller chart signature platform#3787 merged as 3c8048da7603002937ff0ae2a5af2130c15fa3db. Current Platform main pins that same digest and requires the data-product-controller publication workflow identity.

Two acceptance points are therefore evidenced at immutable artifacts: the chart is signed by the intended publisher, and the consumer requires that signer for the exact digest it will install.

This issue stays open for the remaining runtime criterion: Flux must report the verified OCI source Ready. The application is still switched off, so this run made no production activation and does not infer live readiness from the merged manifest.