{"id":15048095,"url":"https://github.com/github/artifact-attestations-helm-charts","last_synced_at":"2026-03-14T03:02:41.655Z","repository":{"id":244836411,"uuid":"807808439","full_name":"github/artifact-attestations-helm-charts","owner":"github","description":"Helm charts for verifying artifact attestations in Kubernetes","archived":false,"fork":false,"pushed_at":"2025-01-27T08:59:26.000Z","size":219,"stargazers_count":11,"open_issues_count":3,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-30T07:42:40.070Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Smarty","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/github.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-29T20:14:49.000Z","updated_at":"2025-01-08T18:41:55.000Z","dependencies_parsed_at":"2024-07-10T16:29:38.350Z","dependency_job_id":"7f47b408-8b21-4743-8d09-fa0a876f28cd","html_url":"https://github.com/github/artifact-attestations-helm-charts","commit_stats":null,"previous_names":["github/artifact-attestations-helm-charts"],"tags_count":14,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fartifact-attestations-helm-charts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fartifact-attestations-helm-charts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fartifact-attestations-helm-charts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fartifact-attestations-helm-charts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/github","download_url":"https://codeload.github.com/github/artifact-attestations-helm-charts/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":237224880,"owners_count":19275102,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-24T21:08:04.747Z","updated_at":"2025-10-19T22:32:50.418Z","avatar_url":"https://github.com/github.png","language":"Smarty","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Artifact Attestations Helm Charts\n\nThis repository hosts GitHub's Helm charts for deploying [a Kubernetes admission controller for Artifact Attestations](https://docs.github.com/en/actions/security-guides/enforcing-artifact-attestations-with-a-kubernetes-admission-controller). This admission controller allows you to enforce the provenance of artifacts deployed to your cluster by verifying their [Artifact Attestations](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds#verifying-artifact-attestations-with-the-github-cli).\n\nThe admission controller consists of:\n- The [`trust-policies` chart](https://github.com/github/artifact-attestations-helm-charts/tree/main/charts/trust-policies), which is used to deploy GitHub's `TrustRoot` and a default `ClusterImagePolicy`. This policy ensures that images installed on a cluster must have provenance attestations generated with the [Attest Build Provenance GitHub Action](https://github.com/actions/attest-build-provenance).\n\nThis chart is published to GitHub Container Registry (GHCR) as an OCI images. Every release is attested with\nthe [Attest Build Provenance Action](https://github.com/github/artifact-attestations-helm-charts/blob/a50f0ad3880a562892156ab8f4ed01a349807bb3/.github/workflows/release.yml#L49).\n\nYou can verify these releases using the [`gh` CLI](https://cli.github.com/manual/gh_attestation_verify):\n```bash\ngh attestation verify --owner github \\\n    oci://ghcr.io/github/artifact-attestations-helm-charts/trust-policies:v0.7.0\n```\n\nFor more information, see [our documentation](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds) on using artifact attestations to establish build provenance and [our blog post](https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/) introducing Artifact Attestations.\n\n## Installation\n### 1. Install the Sigstore Policy Controller\n\nYou will need to install two charts. First, install the Sigstore policy controller:\n\n```bash\nhelm install policy-controller --atomic \\\n  --create-namespace --namespace artifact-attestations \\\n  oci://ghcr.io/sigstore/helm-charts/policy-controller \\\n  --version 0.10.5\n```\n\nThe `--atomic` flag will delete the installation if failure occurs.\nThe `--create-namespace` will create the release namespace if not present.\n\n### 2. Install GitHub's `TrustRoot` and a `ClusterImagePolicy`\n\nNext, install the GitHub `TrustRoot` and our default `ClusterImagePolicy`:\n\n```bash\nhelm install trust-policies --atomic \\\n --namespace artifact-attestations \\\n oci://ghcr.io/github/artifact-attestations-helm-charts/trust-policies \\\n --version v0.7.0 \\\n --set policy.enabled=true \\\n --set policy.organization=MY-ORGANIZATION\n```\n\nBy setting `policy.organization` to a specific organization, the Sigstore policy\ncontroller will verify that the workflow that signed an image's attestation is hosted\nin a repository owned by the specified organization `MY-ORGANIZATION`\n\nSee the [`trust-policies` values.yaml file](charts/trust-policies/values.yaml) for the complete set of\n`ClusterImagePolicy` values that can be customized.\n\n### 3. Enable the policy in your namespace\n\nNow that the `ClusterImagePolicy` has been installed, we must enable it. The policy will not be enforced until you specify which namespaces it should apply to.\n\nEach namespace in your cluster can independently enforce policies. To enable enforcement in a namespace, you can add the following label to the namespace:\n\n```yaml\nmetadata:\n  labels:\n    policy.sigstore.dev/include: true\n```\nAlternatively, you may run:\n\n```bash\nkubectl label namespace MYNAMESPACE policy.sigstore.dev/include=true\n```\n\nSee GitHub's documentation on [Enforcing artifact attestations with a Kubernetes admission controller](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/enforcing-artifact-attestations-with-a-kubernetes-admission-controller) for more information.\n\n## License\n\nThis project is licensed under the terms of the Apache 2.0 open source license. Please refer to [Apache 2.0](./LICENSE) for the full terms.\n\n## Maintainers\n\nSee [CODEOWNERS](./CODEOWNERS) for a list of maintainers.\n\n## Support\n\nIf you have any questions or issues following examples outlined in this repository,\nplease file an [issue](https://github.com/github/artifact-attestations-helm-charts/issues/new?template=Blank+issue) and we will assist you.\n\n## Maintainer Documentation\n\n### Cutting a New Release\n\nWhen you are ready to cut a new release for a given Helm chart\n\n1. Update the chart's `AppVersion` and `Version` to the appropriate values\n2. Create a new tag prefixed with the targeted chart name in the format \u003cmy-chart-name\u003e-v0.1.2, ex: `git tag -s \"trust-policies-v0.7.0\" -m \"trust-policies-v0.7.0\"`\n3. Push the tag, ex: `git push origin \"trust-policies-v0.7.0\"`\n4. The [release workflow](.github/workflows/release.yml) will be triggered if\nthe chart's tag format is included in the list of tags that trigger the workflow.\nThe tag must follow the format `\u003cmy-chart-name\u003e-v\u003csemantic-version\u003e`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Fartifact-attestations-helm-charts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgithub%2Fartifact-attestations-helm-charts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Fartifact-attestations-helm-charts/lists"}