feat(self-hosting): sign and attest published images, and correct the self-hosting docs
Replaces #7432 and #7434, combined into one PR against current staging.
Summary
- Supply chain. Signs every published GHCR image with cosign keyless signing and attaches SLSA provenance and, for single-architecture subjects, a Syft SBOM — all pushed to the registry as referrers so a mirrored registry carries them. A resolver job derives the subjects from the tags each run actually published rather than assuming a fixed set.
- Image inventory.
helm/sim/images.yamllists every image a complete install pulls, generated from the rendered chart, with both the reference to pull from and the path the chart resolves to under a mirror. - Docs. Corrects the self-hosting and enterprise pages against the source, and adds two pages: sandboxes, and per-cloud reference architectures.
Why the subject resolution is not a static list
imagetools create writes an index even from one manifest, so :version-amd64 has a different digest from the :sha-amd64 manifest it wraps, and which tags exist depends on whether the run is a release and whether the latest guard held. A moving alias is attested only when it resolves to this run's index, and that read is retried so registry lag is not mistaken for a deliberate skip. The SBOM is generated from the plain per-architecture manifest, because Syft resolves an index against the runner's platform and an arm64-only index fails outright on an amd64 runner.
Notable doc corrections
openssl rand -hex 32 prints 64 characters, not 32. API_ENCRYPTION_KEY was absent from the Kubernetes path, and unset means API keys are stored in plain text. Bucket fallback was wrong for all three object-storage providers. The proxy section said no platform traffic can be proxied — the server runs on Bun, whose fetch honors the proxy variables. Telemetry is off by default on Helm, not on, and NEXT_TELEMETRY_DISABLED does not gate the browser-event relay. The CronJob count was 18; there are 22. Every "Settings → Enterprise/Security → X" path named nav groups that do not exist. SSO callback URLs hardcoded Sim Cloud's domain on a page with a self-hosted section.
Type of Change
- New feature
- Documentation
Testing
bun run check:audits (45 audits), bun run lint, bun run docs-manifest:check, bun run images:check, actionlint, helm lint, helm template against both CI values files, and the scripts suite (275 tests) all pass. The generated mirror paths were verified against a real mirrored render; the chart's default render is byte-identical to staging apart from the version label.
Checklist
- Code follows project style guidelines
- Self-reviewed my changes
- Tests added/updated and passing
- No new warnings introduced
- I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)
🤖 Generated with Claude Code