feat(supply-chain): sign published images, add a chart image inventory, and correct the self-hosting docs

Closed
WA
2mo ago
+1735-624

Summary

  • Sign every published GHCR image with cosign keyless signing, and attach SLSA provenance and a Syft SBOM as registry referrers. Runs after create-ghcr-manifests because buildx's own attestations break the imagetools create retagging the deploy gate depends on.
  • Add helm/sim/images.yaml — the complete set of images a full install pulls, generated from the rendered chart and drift-checked in the helm workflow. Derived from the render rather than values.yaml because one image (the NVIDIA device plugin) is written directly into a template and no values key names it.
  • Correct the self-hosting and enterprise docs against the source. An audit of 27 pages found claims that made documented paths fail outright, and claims that understated what ships.

What was wrong

  • openssl rand -hex 32 prints 64 hex characters, not the "32 hex chars" five entries claimed.
  • API_ENCRYPTION_KEY was missing from the whole Kubernetes path and marked required elsewhere. It is optional, and unset means API keys are stored in plain text behind one warning.
  • Bucket fallback behavior was wrong for all three object-storage providers, in both directions.
  • The outbound-proxy section said no platform traffic can be proxied. The server runs on Bun, whose fetch honors the proxy variables — replaced with a verified per-path table.
  • Telemetry is off by default on Helm, not on, and enabling the collector collects nothing until NEXT_TELEMETRY_DISABLED is cleared.
  • The CronJob count was 18 in two places; there are 22.
  • Every Settings → Enterprise/Security → X path named nav groups that do not exist, across eleven pages.
  • The permission-group table was stale throughout, named a deployment key that does not exist, and inverted the checkbox semantic.
  • Retention deletion is scheduled by nothing in the chart, so a deployment that followed the docs deleted nothing.

Also documents ~25 environment variables nothing described, the migration advisory lock and its operational knobs, and sim-setup doctor. Moves the sandbox base-image runbook out of the enterprise enablement page into its own self-hosting page rather than losing it. Removes FAQ blocks that restated their own page body and four drifting copies of the same tables.

Type of Change

  • New feature (image signing + inventory)
  • Documentation

Testing

bun run check:audits (45 audits), bun run lint, bun run docs-manifest:check, bun run images:check, actionlint, and the script suite (271 tests) all pass. Chart image list verified against helm template. Every action pinned by SHA and resolved against the GitHub API.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

https://claude.ai/code/session_015BwsJTEQRzWJaY4BRCkPZt