[alangou]

Summary

Sign published OpenShell OCI images and Helm charts with cosign using the publishing workflow's GitHub Actions OIDC identity. The change adds signing to the existing publication jobs without a signing-key secret or a new workflow.

Related Issue

None.

Changes

• Add 33 lines to the release workflows to sign gateway, sandbox, supervisor, helm-chart, and openshell-workspace by manifest digest for stable, prerelease, and dev publications, including both dev chart versions.
• Pin cosign-installer to v4.1.3, which installs cosign v3.1.4. Grant id-token: write to the two signing jobs and reuse their GHCR login. Lookup and signing failures fail the job; retries also sign retained artifacts.
• Document verification and update the related release guidance.

Release Notes

Published runtime images and OCI Helm charts can be verified with cosign 3 using the OpenShell release workflow's identity.

Testing

• Nine tests pass for stable, prerelease, and dev signing scripts, including failed digest lookups and signing failures. Run with uv run --no-project --with pytest --with pyyaml pytest tasks/scripts/oci_signing_test.py.
• Actionlint, ShellCheck for the signing steps, Zizmor at high severity, Ruff, Markdown lint, docs navigation, and Fern validation.
• Confirmed Buildx resolves the manifest digest of an actual OpenShell Helm chart on GHCR.
• Live keyless signing requires a GitHub Actions release run and has not been exercised locally.

Fern reports zero errors and three existing warnings concerning an unrelated gateway configuration page, an unauthenticated redirects check, and theme contrast.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant publication and verification documentation updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5451.docs.buildwithfern.com/openshell