feat: keyless-sign + attest published OCI charts

[dcmcand]

⛔ Blocked by nebari-dev/.github#46 (this pins the sign-oci action from that PR). Do not merge until #46 is merged and v1 is retagged; then flip the pin to @v1.

What

Phase 2 of Nebari artifact signing: keyless-sign + provenance-attest every Helm chart this repo publishes to oci://quay.io/nebari/charts, so the artifact consumers actually helm install is verifiable. Complements the pack-side signing in nebari-dev/.github#46 (which signs container images and the .tgz on the pack's GitHub Release).

How

release-helm-charts.yml:

• Digest capture: the helm push step now records each pushed chart's repo + digest and exposes them as a release job output (charts, a JSON array; empty -> []).
• New sign job: fans out over the pushed charts via a dynamic matrix (fromJSON(needs.release.outputs.charts), guarded to skip when empty), docker logins to quay (cosign reads Docker's config, not helm's), and calls the shared sign-oci composite action per chart.
• Scope: signature + SLSA build provenance, no SBOM (sbom: "false") - syft doesn't meaningfully SBOM a Helm chart artifact.
• Permissions moved to job level: release keeps contents: write; sign gets id-token: write + attestations: write + contents: read.
• Existing packaging / ensure-quay-repos / quay push / gh-pages index behavior is otherwise unchanged.

Signer identity for the OCI charts is this repo's release-helm-charts.yml (distinct from the pack's pack-build-image.yaml / pack-release.yaml identities), as documented in verifying-nebari-artifacts.md.

Dependency / merge order

• Pins nebari-dev/.github/.github/actions/sign-oci@f116e6f (the current feat: reusable signing actions (sign-oci, sign-blob) + wire into pack-build-image .github#46 branch commit). This should merge after docs(sync-chart): point sync PR template at the /sync-rebase trigger #46, and the pin flipped to @v1 once docs(sync-chart): point sync PR template at the /sync-rebase trigger #46 is merged and v1 is retagged.

Verification

• actionlint clean.
• Runtime validation: dispatched on this branch to sign the currently-published charts, then cosign verify an OCI chart against the release-helm-charts.yml identity (evidence added as a comment).

Draft until #46 lands and the pin is flipped to @v1.

[dcmcand]

Runtime validation - OCI chart signing works end-to-end

Dispatched this branch's release-helm-charts.yml (run 29587275447): the release job published, and all 11 sign matrix jobs succeeded (digest capture -> dynamic matrix -> docker login quay -> sign-oci per chart).

cosign verify of a published OCI chart (branch identity, since dispatched from feat/sign-oci-charts):

cosign verify quay.io/nebari/charts/nebari-llm-serving:0.1.2 \
  --certificate-identity-regexp "https://github.com/nebari-dev/helm-repository/\.github/workflows/release-helm-charts\.yml@.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

-> verified: cosign signature (sigstore.dev/cosign/sign/v1) + SLSA provenance (slsa.dev/provenance/v1), transparency log + cert chain checked. No SBOM, as designed.

Notes

• First attempt (run 29586818629) failed at action resolution: GitHub rejects abbreviated cross-repo action SHAs. Fixed by pinning the full 40-char SHA (b1b6df1).
• The signatures created by this validation carry the branch identity (…/release-helm-charts.yml@refs/heads/feat/sign-oci-charts). Once this merges, real releases sign with the @…/main identity; consumer verification uses a @.* regexp that matches either.
• Merge order: depends on feat: reusable signing actions (sign-oci, sign-blob) + wire into pack-build-image .github#46 (the sign-oci action). Keep as draft until docs(sync-chart): point sync PR template at the /sync-rebase trigger #46 merges + v1 is retagged, then flip the pin from the full-SHA phase-1 commit to @v1.