OCI-only chart distribution + admission verification (workstream F)

[nickmarden]

Workstream F — the final supply-chain layer: make the signed OCI chart the primary (and only) published Helm repo, give users a verify-before-install path, and add opt-in admission-time enforcement.

Warning

Breaking change to chart distribution. The GitHub Pages Helm repo (helm repo add ballast https://tight-line.github.io/ballast) no longer receives new versions. It is frozen, not deleted — the existing gh-pages index.yaml stays in place so already-published versions keep resolving for current users. New installs/upgrades use helm install oci://ghcr.io/tight-line/charts/ballast. The OCI chart has been published and cosign-signed since 0.4.9, so only the primary distribution path moves; the artifact itself is unchanged.

F1 — Verify before install (docs)

• README gains a "Verifying the release" section (cosign verify for the image and chart, run before installing) and an "Older releases" section (what changed, where old versions live — the frozen Pages repo — vs new ones on OCI, with the full list on the Releases page). Install/upgrade commands switch to oci://.
• SECURITY.md: fixes the SBOM verify command (--type spdxjson → --type https://spdx.dev/Document/v2.3, since syft emits a versioned predicate type), adds the SLSA-provenance verify + a gh attestation verify alternative, and checks the three Runtime posture boxes (least-privilege RBAC, hardened securityContext, admission guidance).

F2 — Admission-time verification (opt-in examples)

New examples/admission/ with policies for both engines that admit only ghcr.io/tight-line/ballast images carrying a valid keyless cosign signature from the release workflow:

• Kyverno ClusterPolicy (kyverno.io/v1, rule-level failureAction: Enforce, fail-closed webhook).
• sigstore policy-controller ClusterImagePolicy (policy.sigstore.dev/v1beta1, per-namespace opt-in label).

Both pin the exact signing identity (subjectRegExp + issuer) and use the :* colon-glob (not a bare prefix, which would also match sibling repos). The chart does not install these — admission enforcement is cluster-wide and cluster-critical, so it's a deliberate operator decision, not something a workload chart should impose. Syntax verified against current Kyverno and policy-controller docs.

F3 — OCI-only release pipeline

release.yml (release-chart job):

• Removed chart-releaser (which published to gh-pages) and its Configure Git step.
• Kept the signed OCI push + cosign signature + SLSA provenance (unchanged).
• Recreated the per-tag GitHub Release with the gh CLI — no new third-party action (better for the supply-chain story). Auto-generated notes + the packaged ballast-<version>.tgz attached as a convenience asset. Idempotent on tag re-runs.

Releases are now named for their tag (v<version>) rather than ballast-<version>.

Notes for review

• This is tag-only, so release.yml can't be exercised on this PR; the gh release step was written defensively (set -euo pipefail, existence check before create).
• The RBAC posture box checked in SECURITY.md is implemented by Trim operator RBAC to least privilege (workstream E) #84 (workstream E). Both are part of the same series and merge into the same release; I put all three runtime-box flips here to keep the checklist edits in one place.

Validation

• make lint — clean (0 issues)
• make test-coverage-check — passed (no Go changes on this branch)
• Both admission manifests parse as valid Kubernetes YAML (correct apiVersion/kind)
• release.yml — valid YAML; step order and outputs (ref/digest/tgz) wired correctly

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Docker Image Built

docker pull ghcr.io/tight-line/ballast:pr-85-77697b8

Helm (values override)

image:
  repository: ghcr.io/tight-line/ballast
  tag: "pr-85-77697b8"

Image expires ~15 days after PR closes.