Feature Summary

Implement --attest support for the argocd-helm deployer and verify aicr verify handles the Helm chart bundle structure.

Problem/Use Case

PR #527 added the argocd-helm deployer but makeArgoCDHelmChart in bundler.go does not call attestBundle(). The --attest flag is currently rejected with a clear error ("not yet supported"), and --data is similarly rejected.

The other two deployers (helm, argocd) both run attestBundle() and copyDataFiles() as post-generation steps. The argocd-helm path skips both.

Additionally, aicr verify has not been tested against the argocd-helm output structure (Chart.yaml + static/ + templates/), which differs from the flat bundle structure the verifier was designed for.

Proposed Solution

1. Add attestBundle() call to makeArgoCDHelmChart (or shared post-processing)
2. Add copyDataFiles() support (or keep --data rejection if not applicable)
3. Verify aicr verify correctly validates checksums and attestation for the argocd-helm bundle structure
4. Remove the --attest rejection guard once implemented
5. Add test coverage for attested argocd-helm bundles

Component

Bundlers

Priority

Important (feature gap — --attest silently unsupported for one deployer)

Related

• [Feature]: Support dynamic install-time values in bundle output #515
• feat(bundler): add --dynamic flag for install-time values (#515) #527