Add release provenance artifact generation

Author: Copilot

.github/workflows/release.yaml

@@ -21,7 +21,7 @@ jobs:
     steps:
       -
         if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
-        run: echo "flags=--snapshot" >> $GITHUB_ENV
+        run: echo "flags=--snapshot --skip=sign" >> $GITHUB_ENV
       -
         name: Checkout
         uses: actions/checkout@v6
@@ -32,6 +32,10 @@ jobs:
         uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
+      -
+        name: Import GPG key
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        run: echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 --decode | gpg --batch --import
       -
         name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
@@ -41,3 +45,5 @@ jobs:
           args: release --clean ${{ env.flags }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

.goreleaser.yml

@@ -52,6 +52,27 @@ archives:
     - README.md
     - plugin.yaml
     - LICENSE
+
+signs:
+  - id: plugin-provenance
+    artifacts: archive
+    signature: "${artifact}.prov"
+    cmd: sh
+    args:
+      - -ec
+      - |
+        artifact="$1"
+        signature="$2"
+        filename="$(basename "$artifact")"
+        digest="$(sha256sum "$artifact" | cut -d' ' -f1)"
+        {
+          cat plugin.yaml
+          printf '\n...\n'
+          printf 'files:\n  %s: "sha256:%s"\n' "$filename" "$digest"
+        } | gpg --batch --yes --armor --pinentry-mode loopback --passphrase "${GPG_PASSPHRASE:-}" --local-user "$GPG_FINGERPRINT" --clearsign --output "$signature"
+      - --
+      - ${artifact}
+      - ${signature}
 changelog:
   use: github-native
 

README.md

@@ -43,11 +43,7 @@ The install script will skip the GitHub download and instead install from the `.
 
 **For Helm 4 users:**
 
-Helm 4 requires plugin verification by default. Since this plugin does not yet provide provenance artifacts, you need to use the `--verify=false` flag:
-
-```shell
-helm plugin install https://github.com/databus23/helm-diff --verify=false
-```
+Helm 4 verifies plugin provenance by default. This project publishes release provenance artifacts (`.prov`) alongside release tarballs to support verification.
 
 For more information about Helm 4's plugin verification, see:
 - [Helm 4 Overview](https://helm.sh/docs/overview)