Push chart: helm push mychart-1.0.0.tgz oci://ghcr.io/<org>/charts — note the digest printed after push
Pull and install from OCI: helm install myrelease oci://ghcr.io/<org>/charts/mychart --version 1.0.0
To verify provenance, use helm pull --verify oci://ghcr.io/<org>/charts/mychart --version 1.0.0 after configuring a keyring with the chart signer's public key via HELM_GPG_KEYRING or the --keyring flag
Known gotchas
OCI chart repositories are referenced as oci:// URIs, not added with helm repo add — commands like helm repo update and helm search repo do not work with OCI registries; use helm show chart oci://... to inspect metadata
helm push requires the chart to be packaged first; pushing a directory directly is not supported for OCI targets
GHCR package visibility defaults to private; the repository must be explicitly set to public or the pulling principal must have read access via a PAT or OIDC token before helm pull succeeds
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?