Publish Helm plugin provenance artifacts in release pipeline by Copilot · Pull Request #1006 · databus23/helm-diff

Copilot · 2026-06-05T10:17:29Z

Helm v4 verifies plugin provenance by default, but this repo only published .tgz plugin archives, causing installs to fail unless verification was explicitly disabled. This PR adds signed .prov artifacts to releases and updates install guidance accordingly.

Changes

Release artifact signing (.goreleaser.yml)

Added a signs block for archive artifacts.
Generates Helm-compatible provenance files as ${artifact}.prov.
Signs a provenance message containing plugin.yaml metadata + files:<archive>=sha256:<digest> using GPG (clear-signed output Helm can verify).
Passphrase provided via temp file (--passphrase-file) instead of CLI arg to avoid /proc leakage.
Added GPG_FINGERPRINT guard with clear error message on misconfiguration.

Release workflow (.github/workflows/release.yaml)

Imports the release signing key for tagged releases only.
GPG_FINGERPRINT and GPG_PASSPHRASE are set via a conditional step gated on startsWith(github.ref, 'refs/tags/v'), so non-tag/snapshot/PR runs never see these secrets.
Skips signing during snapshot/non-tag runs (--skip=sign).
gpgconf --launch gpg-agent ensures the GPG agent is ready before key import.
Added provenance-smoke-test job that validates the signing script with a disposable GPG key on PR/push runs (no secrets needed).
Added workflow_dispatch trigger for manual testing.
Header comment documents required secrets and key rotation procedure.

Docs update (README.md)

Removed the Helm 4 --verify=false workaround instruction.
Added public key import instructions (gpg --keyserver keys.openpgp.org --recv-keys <FINGERPRINT>).
Notes that the key fingerprint is published in each GitHub release notes.

Prerequisites

Before the first tagged release, configure these repository secrets (Settings > Secrets and variables > Actions):

GPG_PRIVATE_KEY — base64-encoded GPG private key
GPG_FINGERPRINT — Fingerprint of the GPG key
GPG_PASSPHRASE — Passphrase for the GPG private key

Closes

Closes #1005

Copilot

Pull request overview

This PR updates the release pipeline to publish Helm v4-compatible provenance (.prov) artifacts for the plugin archives so Helm installs can succeed with default verification enabled.

Changes:

Added a GoReleaser signing step to generate clear-signed ${archive}.prov provenance files for each published .tgz.
Updated the GitHub Actions release workflow to import the GPG key on tag releases and skip signing for snapshot runs.
Updated README guidance to remove the Helm 4 --verify=false workaround and describe provenance availability.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
README.md	Updates Helm 4 installation guidance to reflect published provenance artifacts.
.goreleaser.yml	Adds signing logic to generate Helm-compatible `.prov` files for archive artifacts.
.github/workflows/release.yaml	Wires GPG key import/secrets and adjusts snapshot flags to skip signing.

+        {
+          cat plugin.yaml
+          printf '\n...\n'
+          printf 'files:\n  %s: "sha256:%s"\n' "$filename" "$digest"
+        } | gpg --batch --yes --armor --pinentry-mode loopback --passphrase "${GPG_PASSPHRASE:-}" --local-user "$GPG_FINGERPRINT" --clearsign --output "$signature"


        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}


yxxhero · 2026-06-06T03:00:22Z

@copilot fix ci isssue and comments.

…tag runs

Copilot · 2026-06-06T03:02:35Z

@copilot fix ci isssue and comments.

Fixed both issues in commit Fix GPG secret handling: use passphrase-file and restrict secrets to tag runs:

.goreleaser.yml – Replaced --passphrase "..." CLI arg with a mktemp-based passphrase file (--passphrase-file), cleaned up via trap. The passphrase is no longer visible in process listings.
.github/workflows/release.yaml – Moved GPG_FINGERPRINT and GPG_PASSPHRASE out of the GoReleaser step's env: block into a conditional "Set GPG environment for signing" step that only runs on tagged releases (startsWith(github.ref, 'refs/tags/v')). Non-tag/snapshot runs no longer have access to these secrets.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

README.md:50

The linked HIP at hips/hip-0026.md is titled "H4HIP: Wasm plugin system", not plugin provenance. The link target may be correct, but the link text is currently inaccurate/misleading for readers looking for provenance documentation.

Helm 4 verifies plugin provenance by default. This project publishes release provenance artifacts (`.prov`) alongside release tarballs to support verification.

For more information about Helm 4's plugin verification, see:
- [Helm 4 Overview](https://helm.sh/docs/overview)
- [HIP-0026: Plugin Provenance](https://github.com/helm/community/blob/main/hips/hip-0026.md)

+        chmod 600 "$passphrase_file"
+        {
+          cat plugin.yaml
+          printf '\n...\n'


- Add gpgconf --launch gpg-agent before GPG key import in CI - Fix provenance separator format to match Helm parser (\n...\n -> ...\n) - Add provenance-smoke-test job that validates signing with disposable key - Add workflow_dispatch trigger for manual testing - Document required GPG secrets and key rotation in workflow header - Update README with public key import guidance for Helm 4 users Signed-off-by: yxxhero <aiopsclub@163.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

-```shell
-helm plugin install https://github.com/databus23/helm-diff --verify=false
-```
+Helm 4 verifies plugin provenance by default. This project publishes GPG-signed provenance artifacts (`.prov`) alongside release tarballs. To verify, import the project's public key into your keyring before running `helm plugin install`.


+        artifact="$1"
+        signature="$2"
+        filename="$(basename "$artifact")"
+        digest="$(sha256sum "$artifact" | cut -d' ' -f1)"


+#   - To rotate: generate a new keypair, update all three secrets, and verify
+#     with a test release (see the test-provenance-sign-dry job)


+          filename="$(basename "$artifact")"
+          digest="$(sha256sum "$artifact" | cut -d' ' -f1)"
+          passphrase_file="$(mktemp)"
+          trap 'rm -f "$passphrase_file"' EXIT


- Add GPG_FINGERPRINT guard with clear error message - Add public key download instructions and fingerprint note to README - Fix header comment referencing provenance-smoke-test job name - Fix double trap overwriting GNUPGHOME cleanup in smoke test - Consolidate cleanup into single trap statement Signed-off-by: yxxhero <aiopsclub@163.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

+        {
+          cat plugin.yaml
+          printf '...\n'
+          printf 'files:\n  %s: "sha256:%s"\n' "$filename" "$digest"
+        } | gpg --batch --yes --armor --pinentry-mode loopback --passphrase-file "$passphrase_file" --local-user "$GPG_FINGERPRINT" --clearsign --output "$signature"


+          gpgconf --launch gpg-agent
+          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 --decode | gpg --batch --import


+          GPG_FINGERPRINT=$(gpg --batch --passphrase '' --quick-generate-key \
+            "helm-diff-test" ed25519 sign 0 2>&1 \
+            | grep -o '[A-F0-9]\{40\}' | head -1)
+          export GPG_FINGERPRINT


+          {
+            cat plugin.yaml
+            printf '...\n'
+            printf 'files:\n  %s: "sha256:%s"\n' "$filename" "$digest"
+          } | gpg --batch --yes --armor --pinentry-mode loopback \



 ```shell
-helm plugin install https://github.com/databus23/helm-diff --verify=false
+gpg --keyserver keys.openpgp.org --recv-keys <KEY_FINGERPRINT>


- Use printf instead of echo for GPG key import to avoid corruption - Use --with-colons --list-secret-keys for reliable fingerprint extraction - Use HKPS keyserver URL in README for TLS-protected key fetch Signed-off-by: yxxhero <aiopsclub@163.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

+helm plugin install https://github.com/databus23/helm-diff
 ```

+The public key fingerprint is published in each GitHub release notes.


+        artifact="$1"
+        signature="$2"
+        filename="$(basename "$artifact")"
+        digest="$(sha256sum "$artifact" | cut -d' ' -f1)"


+          artifact="$tmpdir/helm-diff-linux-amd64.tgz"
+          signature="${artifact}.prov"
+          filename="$(basename "$artifact")"
+          digest="$(sha256sum "$artifact" | cut -d' ' -f1)"
+          printf '%s' "${GPG_PASSPHRASE:-}" > "$passphrase_file"
+          chmod 600 "$passphrase_file"
+          {
+            cat plugin.yaml
+            printf '...\n'
+            printf 'files:\n  %s: "sha256:%s"\n' "$filename" "$digest"
+          } | gpg --batch --yes --armor --pinentry-mode loopback \


- Extract provenance signing to scripts/sign-provenance.sh (used by both goreleaser and smoke test) to prevent logic drift - Add sha256sum fallback to shasum for macOS compatibility - Fix grammar in README key fingerprint sentence Signed-off-by: yxxhero <aiopsclub@163.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Signed-off-by: yxxhero <aiopsclub@163.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

+{
+  cat "$plugin_yaml"
+  printf '...\n'
+  printf 'files:\n  %s: "sha256:%s"\n' "$filename" "$digest"


Signed-off-by: yxxhero <aiopsclub@163.com>

Initial plan

315ca76

Copilot AI assigned Copilot and yxxhero Jun 5, 2026

Copilot started work on behalf of yxxhero June 5, 2026 10:17 View session

Copilot AI linked an issue Jun 5, 2026 that may be closed by this pull request

Add Provenance artifacts to releases #1005

Closed

Add release provenance artifact generation

09104f0

Copilot AI changed the title ~~[WIP] Add provenance artifacts to releases~~ Publish Helm plugin provenance artifacts in release pipeline Jun 5, 2026

Copilot finished work on behalf of yxxhero June 5, 2026 10:27

Copilot AI requested a review from yxxhero June 5, 2026 10:27

yxxhero requested review from Copilot and mumoshu June 6, 2026 01:31

Copilot started reviewing on behalf of yxxhero June 6, 2026 01:31 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

Copilot started work on behalf of yxxhero June 6, 2026 03:00 View session

Fix GPG secret handling: use passphrase-file and restrict secrets to …

b7db1ed

…tag runs

Copilot finished work on behalf of yxxhero June 6, 2026 03:02

yxxhero marked this pull request as ready for review June 6, 2026 03:14

yxxhero requested a review from Copilot June 6, 2026 03:14

Copilot started reviewing on behalf of yxxhero June 6, 2026 03:14 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

Comment thread .goreleaser.yml Outdated

chmod 600 "$passphrase_file"

{

cat plugin.yaml

printf '\n...\n'

yxxhero requested a review from Copilot June 6, 2026 03:41

Copilot started reviewing on behalf of yxxhero June 6, 2026 03:41 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

yxxhero requested a review from Copilot June 6, 2026 03:49

Copilot started reviewing on behalf of yxxhero June 6, 2026 03:49 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

Address remaining PR review comments

ca53393

- Use printf instead of echo for GPG key import to avoid corruption - Use --with-colons --list-secret-keys for reliable fingerprint extraction - Use HKPS keyserver URL in README for TLS-protected key fetch Signed-off-by: yxxhero <aiopsclub@163.com>

yxxhero requested a review from Copilot June 6, 2026 04:01

Copilot started reviewing on behalf of yxxhero June 6, 2026 04:02 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

yxxhero requested a review from Copilot June 6, 2026 05:52

Copilot started reviewing on behalf of yxxhero June 6, 2026 05:52 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

Comment thread .goreleaser.yml

Comment thread README.md

Add offline GPG key import instructions for airgapped environments

c88c0ff

Signed-off-by: yxxhero <aiopsclub@163.com>

yxxhero requested a review from Copilot June 6, 2026 07:11

Copilot started reviewing on behalf of yxxhero June 6, 2026 07:11 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

Comment thread scripts/sign-provenance.sh

Comment on lines +26 to +29

{

cat "$plugin_yaml"

printf '...\n'

printf 'files:\n %s: "sha256:%s"\n' "$filename" "$digest"

Add comment explaining Helm required ...\n provenance separator

373db6f

Signed-off-by: yxxhero <aiopsclub@163.com>

yxxhero merged commit 50d704b into master Jun 6, 2026
25 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Publish Helm plugin provenance artifacts in release pipeline#1006

Publish Helm plugin provenance artifacts in release pipeline#1006
yxxhero merged 9 commits into
masterfrom
copilot/add-provenance-artifacts-to-releases

Copilot AI commented Jun 5, 2026 •

edited by yxxhero

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

yxxhero commented Jun 6, 2026

Uh oh!

Copilot AI commented Jun 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		# - To rotate: generate a new keypair, update all three secrets, and verify
		# with a test release (see the test-provenance-sign-dry job)

		gpgconf --launch gpg-agent
		echo "${{ secrets.GPG_PRIVATE_KEY }}" \| base64 --decode \| gpg --batch --import

Conversation

Copilot AI commented Jun 5, 2026 • edited by yxxhero Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Prerequisites

Closes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

yxxhero commented Jun 6, 2026

Uh oh!

Copilot AI commented Jun 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jun 5, 2026 •

edited by yxxhero

Loading