Feat: Sign Helm Charts on release

[e-minguez]

What type of PR is this?
/kind feature

Any specific area of the project related to this PR?
/area falco-chart

What this PR does / why we need it:
Currently, Helm Charts are not signed. It is an easy process that can be automated.

Which issue(s) this PR fixes:
N/A

Special notes for your reviewer:
I don't have enough permissions to test it. A GPG key needs to be created, stored in GitHub secrets, etc.
The official doc has more information https://helm.sh/docs/topics/provenance/ as well as this blog post I've found (it is for GH Actions but I guess it can be used as inspiration) https://colinwilson.uk/2022/01/27/how-to-sign-helm-charts-using-chart-releaser-action/
Also, this was originally posted in the falco slack channel -> https://kubernetes.slack.com/archives/CMWH3EH32/p1669040410546079

Checklist

• Chart Version bumped
• Variables are documented in the README.md
• CHANGELOG.md updated

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: e-minguez
Once this PR has been reviewed and has the lgtm label, please assign cpanato for approval by writing /assign @cpanato in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[leogr]

cc @cpanato @alacuku

[cpanato]

do we have those secrets setup?

[cpanato]

@leogr note for future, we should move this to github actions :)

[leogr]

do we have those secrets setup?

We only have GPG_KEY within a circleci context named falco. It's base64 encoded IIRC.
You can find some examples of its usage here 👇
https://github.com/falcosecurity/falco/blob/master/.circleci/config.yml#L282

[leogr]

@leogr note for future, we should move this to github actions :)

Totally agree. I believe it's time to make a plan 😃

[Issif]

FYI we started a WG has been created to address the supply chain security subjects

[leogr]

FYI we started a WG has been created to address the supply chain security subjects

Furthermore, we now agreed to deprecate CircleCI in favor of, so this PR should be reworked. @cpanato could you help?
cc @LucaGuerra (for secrets management)

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

/remove-lifecycle stale

@cpanato @LucaGuerra
Any progress on this?

[cpanato]

i will revisit this, totally missed :(

[cpanato]

ok, the idea is to move this to GH actions, correct @leogr , i can work on that but will require us to close this for now, is that okay?

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[cpanato]

need a bit of time here :)

[cpanato]

@leogr @LucaGuerra what is the idea here? we move the job to github actions? I dont remember the context anymore :(

but if that is the idea we will close this PR, if that is okay
waiting a confirmation to start the implementation

[leogr]

Hey @cpanato

Our general idea is to remove CircleCI in favor of GitHub Actions. Most of the repos across the org have already migrated. Notably, this repository is missing.

So I'm open to any plan that allows us to achieve the above goal in this repo too.

[cpanato]

Hey @cpanato

Our general idea is to remove CircleCI in favor of GitHub Actions. Most of the repos across the org have already migrated. Notably, this repository is missing.

So I'm open to any plan that allows us to achieve the above goal in this repo too.

ok, let me work on the transition :)

[cpanato]

we can close this in favor of #554

/close

[poiana]

@cpanato: Closed this PR.

In response to this:

we can close this in favor of #554

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.