[bsinou]

release-manifest writes the image as artifacts[0] and the chart as artifacts[1], and requires both. A component that ships a chart and no image cannot write a manifest: the helm-charts dev builds fail with manifest field .artifacts[0].repository is empty (wireapp/helm-charts run 43219915917), and their releases would fail too (stopgap: wireapp/helm-charts#97).

Change

New input chart-only (default false, so existing callers are unchanged). With chart-only: 'true':

• artifacts is the chart alone (then the extra artifacts), identified by chart-digest, since the chart is already pushed when the manifest is written;
• a release may also give chart-file and chart-sha256 (both or neither); a dev build ignores them as before;
• the image inputs must be empty;
• verify refuses such a manifest with an explicit message: it checks the draft release of an image and its chart, which a chart-only component does not have. complete works unchanged.

The opt-in is explicit rather than inferred from empty image inputs, so that an image component whose build step returned nothing still fails instead of silently writing a chart-only manifest.

Consumers

• The release manager only requires artifacts to be a list (docs/SPEC.md §4.15) and finds the image by type (services/manifests.py, first_image returns None when there is none).
• draft-release.sh reads the artifact files regardless of their position.

Checks

shellcheck, actionlint, zizmor --offline clean; pytest tests: 631 passed, 19 new in tests/test_release_manifest.py.

#6 also edits scripts/release-manifest.sh, in complete only: no overlap with this change.

Once released, helm-charts passes chart-only: 'true' in dev.yml and release.yaml and drops the continue-on-error of #97.

[bsinou]

Security review: No vulnerabilities found.

I reviewed the two changed files that run code, release-manifest/action.yml and scripts/release-manifest.sh. I didn't
review release-manifest/README.md (documentation) or tests/test_release_manifest.py (tests only), as the rules
require. The diff is about 70 changed lines, so I read it directly rather than through a sub-task. With no candidate
findings, there was nothing to send to the false-positive filter.

What I checked:

• No injection through the new input. chart-only reaches the script only as an environment variable (CHART_ONLY: ${{
  inputs.chart-only }}). It is never written into the run: command. The script rejects any value other than true or
  false at scripts/release-manifest.sh:141-144.
• The manifest is built safely. The new value goes into the manifest through jq --arg chart_only, and every other
  field still uses --arg/--argjson. A value can't break the JSON or inject a jq expression.
• The checks are as strict as before. Chart-only manifests must still have a sha256:<64 hex> chart digest, an empty
  image section, and CHART_FILE/CHART_SHA256 given together. A release also needs .source.tag and a valid hex sha256
  when the package hash is present. Existing image-plus-chart manifests keep every check they had.
• verify refuses chart-only manifests. At scripts/release-manifest.sh:300-301 it stops when artifacts[0].type ==
  "chart". It can't misread a chart-only manifest as an image plus chart and pass it with checks skipped. The existing
  check that requires artifacts[0] to be an image and artifacts[1] a chart is still there.
• No new secrets, network calls or file paths are added.