Sign helmchart artifacts

Author: David Collom

.github/workflows/release.yaml

@@ -120,6 +120,9 @@ jobs:
         with:
           path: version-checker
 
+      - name: Setup Cosign
+        uses: sigstore/cosign-installer@main
+
       - name: checkout jetstack-charts
         uses: actions/checkout@v4
         with:
@@ -136,6 +139,11 @@ jobs:
         run: |
           helm package version-checker/deploy/charts/version-checker -d jetstack-charts/charts/
 
+      - name: Sign Helm Chart
+        run: |
+          cosign sign-blob -y jetstack-charts/charts/version-checker-${{steps.release_number.outputs.substring}}.tgz \
+            --bundle jetstack-charts/charts/version-checker-${{steps.release_number.outputs.substring}}.tgz.cosign.bundle
+
       - name: Creating PR
         if: startsWith(github.ref, 'refs/tags/')
         uses: peter-evans/create-pull-request@v7
@@ -145,7 +153,9 @@ jobs:
           commit-message: "Release version-checker ${{github.ref_name }}"
           branch: version-checker/${{github.ref_name}}
           path: jetstack-charts
-          add-paths: charts/*.tgz
+          add-paths: |
+            charts/*.tgz
+            charts/*.tgz.cosign.bundle
           delete-branch: true
           signoff: true
           base: main