feat(helm): publish the chart to GHCR as a signed OCI artifact

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -311,7 +311,7 @@ Setting the variable to an empty string does **not** remove it: the chart reads
 Null the variable in every layer that sets it. If it appears in both `app.env` and `app.envDefaults`, nulling only the `app.env` entry lets the `envDefaults` value apply again and the limit stays in force. With External Secrets, also drop the key from `externalSecrets.remoteRefs.app`, which keeps syncing it independently. Confirm what the pod will actually receive before rolling out:
 
 ```bash
-helm template sim ./helm/sim -f values.yaml | grep -A1 FREE_TABLE   # expect no output
+helm template sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 -f values.yaml | grep -A1 FREE_TABLE   # expect no output
 ```
 
 `null` deletion has no effect under `helm upgrade --reuse-values` — pass your full values with `-f`, or use `--reset-then-reuse-values` (Helm 3.14+). If you deploy with Argo CD, put the `null` in `valueFiles` or the `values` string rather than `valuesObject`, which strips nulls. On Docker Compose, delete the line from your `.env` file.

apps/docs/content/docs/platform/self-hosting/kubernetes.mdx

@@ -21,10 +21,15 @@ import { FAQ } from '@/components/ui/faq'
 
 ## Installation
 
-```bash
-# Clone repo
-git clone https://github.com/simstudioai/sim.git && cd sim
+The chart is published to GitHub Container Registry as an OCI artifact at
+`oci://ghcr.io/simstudioai/charts/sim`. Install it directly — no clone required.
+
+It is also available from a classic Helm repository at `https://charts.sim.ai`
+for tooling that expects one; see [Helm repository](#helm-repository) below.
+Prefer OCI where you can, since the signature and provenance are attached to the
+OCI artifact.
 
+```bash
 # Generate secrets
 BETTER_AUTH_SECRET=$(openssl rand -hex 32)
 ENCRYPTION_KEY=$(openssl rand -hex 32)
@@ -34,7 +39,8 @@ CRON_SECRET=$(openssl rand -hex 32)
 POSTGRES_PASSWORD=$(openssl rand -hex 24)
 
 # Install
-helm install sim ./helm/sim \
+helm install sim oci://ghcr.io/simstudioai/charts/sim \
+  --version 1.9.5 \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
   --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
@@ -56,13 +62,58 @@ helm install sim ./helm/sim \
   This installs the chart's default image tag. For production, **pin `app`, `realtime`, and `migrations` to the same explicit release tag** — see [Upgrades](/platform/self-hosting/upgrades).
 </Callout>
 
+## Helm repository
+
+For clusters or GitOps configs that consume `helm repo add` rather than OCI:
+
+```bash
+helm repo add sim https://charts.sim.ai
+helm repo update
+
+helm install sim sim/sim --version 1.9.5 --namespace simstudio --create-namespace \
+  --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+  --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
+  --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
+  --set app.env.API_ENCRYPTION_KEY="$API_ENCRYPTION_KEY" \
+  --set app.env.CRON_SECRET="$CRON_SECRET" \
+  --set postgresql.auth.password="$POSTGRES_PASSWORD"
+```
+
+It serves the same chart as the OCI registry. The signature and provenance below
+apply to the OCI artifact only.
+
+## Verifying the chart
+
+Every published version is signed with Sigstore keyless signing and carries a SLSA build-provenance attestation. Both live in the registry alongside the chart, so they survive a mirror into an internal registry.
+
+```bash
+cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.5 \
+  --certificate-identity-regexp '^https://github.com/simstudioai/sim/' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com
+
+gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.5 --repo simstudioai/sim
+```
+
+Signing is Sigstore-only — there is no GPG `.prov` file, so `helm install --verify` does not apply.
+
+<Callout type="warn">
+  Verification requires **cosign v3.0 or newer**. Signatures use the Sigstore protobuf bundle format, which cosign v3 writes by default and cosign v2 cannot read. cosign v3.1+ auto-detects both formats.
+</Callout>
+
 ## Cloud-Specific Values
 
 These are cloud-tuned **alternatives** to the generic install above — pick one path, don't run both. The commands reuse the `$BETTER_AUTH_SECRET`, `$ENCRYPTION_KEY`, `$INTERNAL_API_SECRET`, `$API_ENCRYPTION_KEY`, `$CRON_SECRET`, and `$POSTGRES_PASSWORD` variables generated in [Installation](#installation) above, so run that block's `openssl` lines first in the same shell. They use `helm upgrade --install`, so they work whether or not a release exists yet. Two caveats when converting an existing generic install rather than starting fresh: (1) **reuse the original secret values** — recover them with `helm get values sim -n simstudio` if your shell no longer has them; supplying a newly generated `ENCRYPTION_KEY` makes every previously encrypted value (workspace environment variables, stored provider keys, MCP OAuth credentials) undecryptable. (2) The cloud values rename the bundled PostgreSQL database to `simstudio`, but Postgres only applies that setting on first initialization — add `--set postgresql.auth.database=sim` to keep your existing database. If you'd rather start clean, `helm uninstall sim -n simstudio`, delete its PVCs, and run the cloud command fresh.
 
 ```bash
-helm upgrade --install sim ./helm/sim \
-  --values ./helm/sim/examples/values-aws.yaml \
+# The example values files are not part of the packaged chart, so fetch the one
+# you want at a release tag — pinning the chart but reading values off a moving
+# branch would still make this command produce different deployments over time.
+SIM_RELEASE=v0.8.24
+curl -fsSLO "https://raw.githubusercontent.com/simstudioai/sim/$SIM_RELEASE/helm/sim/examples/values-aws.yaml"
+
+helm upgrade --install sim oci://ghcr.io/simstudioai/charts/sim \
+  --version 1.9.5 \
+  --values values-aws.yaml \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
   --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
@@ -80,7 +131,7 @@ helm upgrade --install sim ./helm/sim \
 
 Every one of those overrides is required. The cloud values files hardcode a placeholder domain in all six places, and overriding only `NEXT_PUBLIC_APP_URL` leaves sign-in pointed at the placeholder, realtime rejecting every socket upgrade, and the Ingress serving the wrong host.
 
-Swap the `--values` file for your cloud: `values-aws.yaml` (EKS), `values-azure.yaml` (AKS), or `values-gcp.yaml` (GKE). Everything else is identical.
+Swap the `--values` file for your cloud: `values-aws.yaml` (EKS), `values-azure.yaml` (AKS), or `values-gcp.yaml` (GKE). Everything else is identical. Keep the downloaded file in your own config repo — the `--set` overrides above cover the six placeholder domains, but anything else you tune belongs in the file.
 
 ## Key Configuration
 
@@ -181,8 +232,8 @@ kubectl port-forward deployment/sim-app 3000:3000 -n simstudio
 # View logs
 kubectl logs -l app.kubernetes.io/component=app -n simstudio --tail=100
 
-# Upgrade
-helm upgrade sim ./helm/sim --namespace simstudio
+# Upgrade (always pin the target chart version)
+helm upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 --namespace simstudio
 
 # Uninstall
 helm uninstall sim --namespace simstudio

apps/docs/content/docs/platform/self-hosting/reference-architectures.mdx

@@ -139,16 +139,23 @@ See [Security](/platform/self-hosting/security) for the full secret inventory, w
 
 ## Calling the chart from Terraform
 
-If you already run Terraform, the chart is the resource to wrap — not something to reimplement. It is not published to a Helm repository or an OCI registry, so there is no `repository` to point at: vendor this repo as a submodule, a release tarball, or a `git clone` in your pipeline, and give `chart` the local path.
+If you already run Terraform, the chart is the resource to wrap — not something to reimplement. Point `repository` at the OCI registry and pin `version`; there is no need to vendor the repo.
 
 ```hcl
 resource "helm_release" "sim" {
   name             = "sim"
   namespace        = "sim"
   create_namespace = true
 
-  # Local path, not a repository. Pin the git ref you vendor from.
-  chart = "${path.module}/sim/helm/sim"
+  # Always pin `version`. Without it Terraform resolves the newest published
+  # chart at apply time, which is how an unplanned apply moves Sim to a new
+  # release with new migrations.
+  repository = "oci://ghcr.io/simstudioai/charts"
+  chart      = "sim"
+  version    = "1.9.5"
+
+  # Or the classic repository, if your tooling does not speak OCI:
+  #   repository = "https://charts.sim.ai"
 
   # Your own values file. The examples under helm/sim/examples/ carry
   # placeholder secrets and are starting points, not deployable as-is.
@@ -172,6 +179,6 @@ resource "helm_release" "sim" {
   The example values files ship literal placeholders such as `your-secure-production-auth-secret-here`. That includes `postgresql.auth.password`. The chart only rejects empty values and its own `CHANGE-ME` strings, so a deployment that inherits those placeholders installs cleanly with a publicly known session-signing secret and database password. Override every secret, or use External Secrets and set none of them inline.
 </Callout>
 
-Because the chart is local, `version` does nothing — what pins it is the git ref you vendor from, and `helm/sim/Chart.yaml` tells you which chart release that ref carries. Pin that ref, and pin the image tags separately, or an unplanned `terraform apply` can move Sim to a new release with new migrations. See [Upgrades](/platform/self-hosting/upgrades).
+Pin `version` above, and pin the image tags separately — the chart version and the application version move independently, so pinning one does not pin the other. See [Upgrades](/platform/self-hosting/upgrades).
 
 Once the infrastructure exists, follow [Kubernetes](/platform/self-hosting/kubernetes) for the install itself, then the [pre-launch checklist](/platform/self-hosting/security) and the [verification checklist](/platform/self-hosting/verify).

apps/docs/content/docs/platform/self-hosting/upgrades.mdx

@@ -156,15 +156,16 @@ Migration surprises are usually data-shaped rather than schema-shaped, so a stag
   <Tab value="Kubernetes (Helm)">
 
 ```bash
-helm upgrade sim ./helm/sim \
+helm upgrade sim oci://ghcr.io/simstudioai/charts/sim \
+  --version 1.9.5 \
   --namespace simstudio \
   --values my-values.yaml
 ```
 
 Preview first if the chart version changed:
 
 ```bash
-helm diff upgrade sim ./helm/sim -n simstudio --values my-values.yaml
+helm diff upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 -n simstudio --values my-values.yaml
 ```
 
 Then watch the rollout:

helm/artifacthub-repo.yml

@@ -0,0 +1,22 @@
+# Artifact Hub repository metadata for the Sim chart.
+#
+# Lives outside `helm/sim/` on purpose: it describes the *repository* rather
+# than the chart, so it must not be packaged into the `.tgz`, and a change to it
+# must not trip the chart's mandatory Chart.yaml version bump.
+#
+# The publish job pushes this file to the OCI registry under the reserved
+# `artifacthub.io` tag, which is where Artifact Hub looks for it:
+#   ghcr.io/simstudioai/charts/sim:artifacthub.io
+#
+# `owners` is what backs an ownership claim — Artifact Hub matches the email of
+# the requesting account against this list, and processes claims immediately
+# rather than waiting for the next repository scan.
+owners:
+  - name: Sim Team
+    email: help@sim.ai
+
+# Set this to the repository's Artifact Hub ID once the repository has been
+# registered at https://artifacthub.io/control-panel/repositories. It is what
+# turns on the "Verified Publisher" badge; until then the listing still works,
+# just unverified.
+# repositoryID: ""

helm/sim/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.9.0
-appVersion: "v0.8.18"
+version: 1.9.5
+appVersion: "v0.8.24"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai
 icon: https://raw.githubusercontent.com/simstudioai/sim/main/apps/sim/public/logo/primary/primary.svg
@@ -21,6 +21,9 @@ keywords:
   - nextjs
 annotations:
   category: developer-tools
+  # Artifact Hub only accepts one value from its fixed list; the bare `category`
+  # above is a different convention and does not categorise the listing.
+  artifacthub.io/category: ai-machine-learning
   artifacthub.io/license: Apache-2.0
   artifacthub.io/links: |
     - name: Homepage