feat: start verifying charts before use (#2738)

* feat: start verifying charts before use

* add make target for updating public key

* Apply suggestion from @petewall

Co-authored-by: Pete Wall <pete.wall@grafana.com>

* chore: regenerate kubernetes-manifests example output for k8s-manifest-tail 0.1.5

* chore: add changelog entry for k8s-manifest-tail 0.1.5

---------

Co-authored-by: Pete Wall <pete.wall@grafana.com>

Author: TylerHelmuth

.github/workflows/release.yml

@@ -7,7 +7,26 @@ on:
 permissions: {}
 
 jobs:
+  verify-signatures:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: 'false'
+
+      - name: Set up Helm
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2  # v5.0.0
+        with:
+          version: v4.1.4
+
+      - name: Verify signed chart dependencies
+        run: make -C charts/k8s-monitoring verify-signatures
+
   release-chart:
+    needs: verify-signatures
     # Pinned to the hackathon branch: this version of the shared workflow packages, signs,
     # pushes to GHCR, regenerates the helm repo index, and creates the canonical release on
     # grafana/helm-charts. The source-repo `release` job below only links back to it.

Makefile

@@ -33,6 +33,13 @@ clean: ## Clean all charts
 build: check-helm-version ## Build all charts
 	make -C charts/k8s-monitoring $@;
 
+##@ Keys
+.PHONY: update-signing-keys
+update-signing-keys: keys/grafana-helm-charts-pubkey.gpg ## Refresh signing keys in keys/ from 1Password (requires the op CLI)
+
+keys/grafana-helm-charts-pubkey.gpg:
+	op --account grafana.1password.com read "op://Helm Maintainers/Helm Chart Signing Key/gpg-public-key.asc" | gpg --dearmor > keys/grafana-helm-charts-pubkey.gpg
+
 ##@ Install
 .PHONY: install
 install: ## Install dependencies

charts/k8s-monitoring/CHANGELOG.md

@@ -5,6 +5,7 @@
 *   Fix the Beyla `SecurityContextConstraints` on OpenShift to set `allowHostPorts: true`. Beyla runs with host networking when context propagation or the `network` preset is enabled, which OpenShift treats as host-port usage. Without it, the Beyla DaemonSet pods fail SCC admission with `Host ports are not allowed to be used`. (#2734) (@petewall)
 *   Fix the OTLP destination `timeout` setting rendering inside the `client` block for `protocol: grpc`, which Alloy rejects. It now renders as a top-level argument for gRPC and inside `client` for HTTP. (#2710) (@petewall)
 *   Add `openTelemetryConversion.keepIdentifyingResourceAttributes` option to `otelcol.exporter.prometheus` component to optionally preserve `service.name`, `service.namespace`, and `service.instance.id` attributes as labels on `target_info` metric during OTLP to Prometheus conversion. (#2718) (@rlankfo)
+*   Update k8s-manifest-tail to 0.1.5 (@TylerHelmuth)
 
 ## 4.1.6
 

charts/k8s-monitoring/Makefile

@@ -271,6 +271,11 @@ build-features:
 		make -C $$chart build; \
 	done
 
+# Verify the signatures of signed Grafana chart dependencies.
+.PHONY: verify-signatures
+verify-signatures:
+	make -C charts/telemetry-services verify-signatures
+
 # Build targets
 .PHONY: build
 build: build-features values.schema.json templates/destinations/_destination_types.tpl collectors/upstream/alloy-values.yaml build-docs examples integration-test-checks platform-test-checks

charts/k8s-monitoring/charts/telemetry-services/Chart.lock

@@ -16,6 +16,6 @@ dependencies:
   version: 2.5.23
 - name: k8s-manifest-tail
   repository: https://grafana.github.io/helm-charts
-  version: 0.1.4
-digest: sha256:1ae281a14a84db859e442bfe2bface7e5d7b64521e6382880bd9932a25633e6b
-generated: "2026-06-16T09:40:42.698796-05:00"
+  version: 0.1.5
+digest: sha256:db919004fbac4ec689a26a28f380fc97828cefc5726b97fcc6523f235f9d1251
+generated: "2026-06-24T11:17:43.077795-06:00"

charts/k8s-monitoring/charts/telemetry-services/Chart.yaml

@@ -37,6 +37,6 @@ dependencies:
     condition: opencost.deploy
   - alias: k8s-manifest-tail
     name: k8s-manifest-tail
-    version: 0.1.4
+    version: 0.1.5
     repository: https://grafana.github.io/helm-charts
     condition: k8s-manifest-tail.deploy

charts/k8s-monitoring/charts/telemetry-services/Makefile

@@ -7,11 +7,14 @@ endif
 
 HAS_HELM_UNITTEST := $(shell $(HELM) plugin list | grep unittest 2> /dev/null)
 
+K8S_MANIFEST_TAIL_VERSION := $(shell yq '.dependencies[] | select(.name == "k8s-manifest-tail") | .version' Chart.yaml)
+GRAFANA_HELM_CHARTS_KEYRING := ../../../../keys/grafana-helm-charts-pubkey.gpg
+
 .SECONDEXPANSION:
 README.md: values.yaml Chart.yaml $$(wildcard README.md.gotmpl)
 	docker run --rm --platform linux/amd64 --volume $(shell pwd):/chart ghcr.io/grafana/helm-chart-toolbox-doc-generator --chart /chart > $@
 
-Chart.lock: Chart.yaml
+Chart.lock: Chart.yaml | verify-signatures
 	$(HELM) dependency update .
 	@touch Chart.lock # Ensure the timestamp is updated
 
@@ -25,6 +28,14 @@ clean:
 .PHONY: build
 build: README.md Chart.lock values.schema.json $(ALLOW_LISTS)
 
+.PHONY: verify-signatures
+verify-signatures: ## Verify the signature of the signed k8s-manifest-tail chart dependency
+	$(HELM) pull k8s-manifest-tail \
+		--repo https://grafana.github.io/helm-charts \
+		--version $(K8S_MANIFEST_TAIL_VERSION) \
+		--verify --keyring $(GRAFANA_HELM_CHARTS_KEYRING) \
+		--destination "$$(mktemp -d)"
+
 .PHONY: test
 test: build
 	$(HELM) repo add prometheus-community https://prometheus-community.github.io/helm-charts

charts/k8s-monitoring/charts/telemetry-services/README.md

@@ -36,7 +36,7 @@ telemetryServices:
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://grafana.github.io/helm-charts | k8s-manifest-tail(k8s-manifest-tail) | 0.1.4 |
+| https://grafana.github.io/helm-charts | k8s-manifest-tail(k8s-manifest-tail) | 0.1.5 |
 | https://opencost.github.io/opencost-helm-chart | opencost | 2.5.23 |
 | https://prometheus-community.github.io/helm-charts | kube-state-metrics | 7.5.1 |
 | https://prometheus-community.github.io/helm-charts | node-exporter(prometheus-node-exporter) | 4.55.0 |