New workflow to publish the public key to gh-pages

Signed-off-by: Pete Wall <pete.wall@grafana.com>

Author: petewall

.github/workflows/publish-public-signing-key.yaml

@@ -0,0 +1,48 @@
+name: Publish public signing key
+
+# Publishes the Helm chart signing public key to the gh-pages branch as pubkey.gpg
+# (a binary/dearmored GPG keyring) so users can import it and verify chart provenance:
+#   curl https://grafana.github.io/helm-charts/pubkey.gpg | gpg --import
+# See the "Helm Provenance and Integrity" section of the README.
+on:
+  workflow_dispatch: {}
+
+permissions: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # allows fetching the signing key from Vault via OIDC
+      contents: write # allows committing pubkey.gpg to the gh-pages branch
+    steps:
+      # ghcommit-action computes the file change against the checked-out branch, so we
+      # check out gh-pages at the workspace root and write pubkey.gpg there.
+      - name: Checkout gh-pages
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        with:
+          ref: gh-pages
+          persist-credentials: false
+
+      - name: Fetch public signing key from Vault
+        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760 # v1.1.0
+        with:
+          repo_secrets: |
+            PUBLIC_KEY=helm-chart-signing-key:public_key
+
+      - name: Convert ASCII-armored key to binary GPG keyring
+        run: |
+          printf '%s' "${PUBLIC_KEY}" | gpg --dearmor > pubkey.gpg
+
+      # Commit via the GitHub GraphQL `createCommitOnBranch` mutation so the commit is signed
+      # by GitHub's web-flow key (shown as Verified). This matches how index.yaml is published
+      # and works with the "Require signed commits" branch protection on gh-pages.
+      - name: Publish pubkey.gpg to gh-pages
+        uses: planetscale/ghcommit-action@25309d8005ac7c3bcd61d3fe19b69e0fe47dbdde # v0.2.20
+        with:
+          commit_message: "Publish Helm chart public signing key (pubkey.gpg)"
+          repo: ${{ github.repository }}
+          branch: gh-pages
+          file_pattern: pubkey.gpg
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -21,6 +21,31 @@ You can then run `helm search repo grafana` to see the charts.
 <!-- Keep full URL links to repo files because this README syncs from main to gh-pages.  -->
 Chart documentation is available in [grafana directory](https://github.com/grafana/helm-charts/blob/main/charts/grafana/README.md).
 
+## Helm Provenance and Integrity
+
+Charts in this repository may be signed, allowing you to verify their integrity and
+origin. More information about how provenance works can be found in the official
+[Helm documentation](https://helm.sh/docs/topics/provenance/).
+
+A local running GPG agent is required to complete the verification process.
+
+To add the public signing key to your keyring, run:
+
+```console
+curl https://grafana.github.io/helm-charts/pubkey.gpg | gpg --import
+```
+
+Depending on your GnuPG version (2.1+ in particular), you may need to export the
+imported key so that Helm can find it:
+
+```console
+gpg --export > ~/.gnupg/pubring.gpg
+```
+
+Once your keyring is configured, pass the `--verify` flag to `helm install`,
+`helm upgrade`, `helm pull`, or `helm template` to validate a chart's signature and
+confirm its authenticity.
+
 ## Contributing
 
 <!-- Keep full URL links to repo files because this README syncs from main to gh-pages.  -->