chore: implement permission best practive and helm chart signed to satisfy openssf checks

Author: aardbol

.github/workflows/_reusable-build.yaml

@@ -13,6 +13,8 @@ on:
         required: true
         type: string
 
+permissions: read-all
+
 env:
   REGISTRY: ghcr.io
 

.github/workflows/codeql-analysis.yaml

@@ -15,6 +15,8 @@ on:
 env:
   GO_VERSION: '1.26'
 
+permissions: read-all
+
 jobs:
   analyze:
     name: Analyze

.github/workflows/links.yaml

@@ -5,6 +5,8 @@ on:
     - cron: "00 18 * * 1"
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   check:
     runs-on: ubuntu-24.04

.github/workflows/lint-golang.yaml

@@ -13,6 +13,8 @@ on:
 env:
   GO_VERSION: '1.26'
 
+permissions: read-all
+
 jobs:
   golangci-lint:
     name: golangci-lint

.github/workflows/lint-helm.yaml

@@ -8,6 +8,8 @@ on:
       - '.github/workflows/lint-helm.yaml'
   pull_request:
 
+permissions: read-all
+
 jobs:
   helm-lint:
     name: helm-lint

.github/workflows/release-helm.yaml

@@ -64,6 +64,10 @@ jobs:
     needs: [detect, e2e]
     if: ${{ always() && needs.detect.outputs.skip == 'false' && (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') }}
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
@@ -85,6 +89,12 @@ jobs:
           mkdir -p dist
           helm package ${{ env.CHART_DIR }} --destination dist
 
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign chart package
+        run: |
+          cosign sign-blob dist/*.tgz --output-signature dist/*.tgz.sig --yes
+
       - name: Push chart to GHCR OCI
         run: |
           helm push dist/*.tgz oci://${{ env.REGISTRY }}/${{ env.CHART_OCI_REPO }}
@@ -106,6 +116,7 @@ jobs:
           fi
           gh release create "helm-v${{ needs.detect.outputs.chart_version }}" \
             dist/*.tgz \
+            dist/*.sig \
             --notes-file .release_notes \
             --title "helm-v${{ needs.detect.outputs.chart_version }}" \
             --draft \

.github/workflows/test-integration.yaml

@@ -6,6 +6,8 @@ on:
 env:
   GO_VERSION: '1.26'
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-24.04

.github/workflows/test.yaml

@@ -15,6 +15,8 @@ on:
 env:
   GO_VERSION: '1.26'
 
+permissions: read-all
+
 jobs:
   test:
     runs-on: ubuntu-24.04

deploy/helm/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Helm chart changelog
 
+## [1.9.4] - 2026-06-28
+
+### Added
+- Chart packages are signed too now
+
 ## [1.9.3] - 2026-06-26
 
 ### Changed

deploy/helm/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: upcloud-csi
 description: CSI driver for UpCloud block storage
 type: application
-version: "1.9.3"
+version: "1.9.4"
 appVersion: "v2.8.3"
 kubeVersion: ">=1.21.0"
 keywords: