chore: supply-chain + CI polish

- release: drop buildx-embedded SBOM; anchore is sole source and the
  only input to the cosign SBOM attestation
- release: cosign-sign image digest once (was signing per-tag, all tags
  resolve to same digest)
- release: cosign-sign Helm chart OCI artifact against digest captured
  from `helm push`
- ci: add `ct lint --all` alongside `helm lint` / `helm template`
- Dockerfile: pip `--disable-pip-version-check` (hadolint DL3042)
- README: Verifying a release section — image sig, SBOM attestation,
  `gh attestation verify`, chart sig, `helm pull --verify`
- CHANGELOG: populate [Unreleased]

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Varashi

.github/workflows/ci.yaml

@@ -39,6 +39,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: azure/setup-helm@v4
         with:
           version: v3.16.3
@@ -53,6 +55,14 @@ jobs:
           helm template ci chart/ \
             --set vcenter.existingSecret=my-eso-secret \
             --set vcenter.caBundle.configMapName=vcenter-ca > /dev/null
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - uses: helm/chart-testing-action@v2
+      - name: ct lint
+        # Catches SemVer/maintainer/icon/README drift that plain `helm lint`
+        # misses. `--all` since this repo has a single chart in chart/.
+        run: ct lint --all --chart-dirs . --validate-maintainers=false
 
   image:
     name: image / buildx smoke

.github/workflows/release.yaml

@@ -82,7 +82,10 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           provenance: true
-          sbom: true
+          # SBOM is produced downstream by anchore/sbom-action and attached
+          # as a cosign attestation, so skip the buildx-embedded SBOM to
+          # avoid two different SBOMs against the same digest.
+          sbom: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -92,11 +95,10 @@ jobs:
       - name: Cosign keyless sign
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-        run: |
-          for tag in $TAGS; do
-            cosign sign --yes "${tag}@${DIGEST}"
-          done
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        # All tags point at the same digest; sign the digest once rather
+        # than re-signing it per tag.
+        run: cosign sign --yes "${IMAGE}@${DIGEST}"
 
       - name: Generate SBOM (SPDX)
         uses: anchore/sbom-action@v0
@@ -142,10 +144,24 @@ jobs:
                 --username ${{ github.actor }} --password-stdin
 
       - name: Push Helm chart (OCI)
+        id: chart_push
         run: |
           version="${{ steps.ver.outputs.version }}"
+          # helm push prints "Digest: sha256:..." to stderr; tee to capture.
           helm push "gpu-node-vsphere-maintenance-controller-${version}.tgz" \
-            "oci://${{ env.CHART_REPO }}"
+            "oci://${{ env.CHART_REPO }}" 2>&1 | tee push.log
+          digest=$(awk '/^Digest: /{print $2}' push.log)
+          if [ -z "$digest" ]; then
+            echo "Failed to capture chart digest" >&2
+            exit 1
+          fi
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
+
+      - name: Cosign keyless sign (chart)
+        env:
+          DIGEST: ${{ steps.chart_push.outputs.digest }}
+          CHART_REF: ${{ env.CHART_REPO }}/gpu-node-vsphere-maintenance-controller
+        run: cosign sign --yes "${CHART_REF}@${DIGEST}"
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2

CHANGELOG.md

@@ -7,6 +7,29 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+### Added
+- README "Verifying a release" section with cosign verify, cosign
+  verify-attestation, `gh attestation verify`, and `helm pull --verify`
+  snippets for the published image and chart.
+- Release workflow now cosign-keyless-signs the published Helm chart OCI
+  artifact as well as the image, against the digest returned by
+  `helm push`.
+- CI `chart` job runs `helm/chart-testing` `ct lint` in addition to
+  `helm lint` and `helm template`, catching SemVer and metadata drift
+  that plain `helm lint` misses.
+
+### Changed
+- Release workflow signs the image digest once rather than once per tag —
+  all tags resolve to the same digest, so per-tag signing only recorded
+  duplicate signatures against the same subject.
+- Release workflow disables the buildx-embedded SBOM (`sbom: false` on
+  `docker/build-push-action`). `anchore/sbom-action` remains the single
+  source of the SPDX SBOM and the only input to the cosign SBOM
+  attestation, so image consumers no longer see two SBOMs referencing
+  the same digest.
+- Dockerfile `pip install` now passes `--disable-pip-version-check` to
+  pre-empt hadolint `DL3042` and trim startup noise.
+
 ## [0.4.1] — 2026-04-21
 
 ### Added

Dockerfile

@@ -8,7 +8,8 @@ LABEL org.opencontainers.image.licenses="MIT"
 
 WORKDIR /app
 
-RUN pip install --no-cache-dir pyVmomi==8.0.3.0.1 kubernetes==31.0.0
+RUN pip install --no-cache-dir --disable-pip-version-check \
+      pyVmomi==8.0.3.0.1 kubernetes==31.0.0
 
 COPY controller.py .
 

README.md

@@ -411,13 +411,44 @@ The `release.yaml` GitHub Actions workflow then:
    section of [`CHANGELOG.md`](./CHANGELOG.md) and attaches the SBOM and
    the packaged chart `.tgz`.
 
-Verify a release image signature locally:
+### Verifying a release
+
+Every release is cosign-keyless-signed (GitHub OIDC), carries a SLSA build
+provenance attestation pushed to the registry, and has the SPDX SBOM
+attached as a cosign attestation. Verify any of these before deploying:
 
 ```bash
+# 1. Image signature.
 cosign verify \
   --certificate-identity-regexp 'https://github\.com/Varashi/gpu-node-vsphere-maintenance-controller/\.github/workflows/release\.yaml@refs/tags/v.*' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   ghcr.io/varashi/gpu-node-vsphere-maintenance-controller:<tag>
+
+# 2. SBOM attestation (SPDX).
+cosign verify-attestation --type spdxjson \
+  --certificate-identity-regexp 'https://github\.com/Varashi/gpu-node-vsphere-maintenance-controller/\.github/workflows/release\.yaml@refs/tags/v.*' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+  ghcr.io/varashi/gpu-node-vsphere-maintenance-controller:<tag>
+
+# 3. SLSA build provenance (GitHub Attestations).
+gh attestation verify \
+  oci://ghcr.io/varashi/gpu-node-vsphere-maintenance-controller:<tag> \
+  --owner Varashi
+```
+
+Verify the Helm chart the same way — the release workflow signs chart
+digests too:
+
+```bash
+cosign verify \
+  --certificate-identity-regexp 'https://github\.com/Varashi/gpu-node-vsphere-maintenance-controller/\.github/workflows/release\.yaml@refs/tags/v.*' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+  ghcr.io/varashi/charts/gpu-node-vsphere-maintenance-controller:<tag>
+
+# Or pull + verify in one shot (requires helm 3.8+ experimental OCI).
+helm pull \
+  oci://ghcr.io/varashi/charts/gpu-node-vsphere-maintenance-controller \
+  --version <tag> --verify
 ```
 
 ## Version history