[sunib]

Stacked on #37; retarget to main once that merges.

Why the 0.1.0 release failed

publish the Helm chart pushed ghcr.io/configbutler/charts/krm-foyer:0.1.0, then
actions/attest-build-provenance (push-to-registry: true) failed with
No credentials found for registry ghcr.io: helm had logged in inside the CI container,
and the attestation runs on the runner, which had no login.

What changes: the release pipeline follows gitops-reverser's

• CI before release-please, so a red commit never gets a release.
• Draft releases. The repository has immutable releases switched on, so a published
  release accepts no assets. release-please creates a draft (draft: true), the publish
  jobs attach to it, publish-release publishes it last, and release-please-pr opens
  the next release PR against the published release.
• Image: cosign keyless signature, SLSA provenance and SPDX SBOM attestations; the SBOM
  goes on the release with its .sigstore.json and .intoto.jsonl (Scorecard's
  Signed-Releases check). Release notes show how to install and verify.
• Chart: signed with cosign instead of attested, as gitops-reverser does, which also
  removes the step 0.1.0 failed on. Each tool logs in for itself.
• Artifact Hub: charts/artifacthub-repo.yml pushed with oras under the
  artifacthub.io tag. No repositoryID yet; it comes from the Artifact Hub control panel.
• CI image: cosign v3.1.3 and oras 1.3.4 in the ci stage, each checked against its
  release's checksum file; the CI tool check runs both.

Deliberate differences from gitops-reverser: the image is built in the release job (amd64
only, and krm-foyer's CI does not push), and each chart step docker-runs the CI image,
which is a workflow artifact rather than a registry image, so container: is not available.

Verified

• task verify passes; the ci stage builds with cosign v3.1.3 and oras 1.3.4.
• The checksum check accepts the real archive and rejects a tampered one and a missing entry.
• The oras push ran against a local registry:2; the manifest has Artifact Hub's config
  and layer media types.
• The publish jobs themselves only run on a release.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 4 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2b0f335a-b062-4537-8774-1518517f7be5

📥 Commits

Reviewing files that changed from the base of the PR and between b9b13ad and 41ba9a4.

📒 Files selected for processing (6)

• .devcontainer/Dockerfile
• .github/workflows/ci.yml
• .github/workflows/release.yml
• charts/artifacthub-repo.yml
• docs/roadmap.md
• release-please-config.json

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}