docs(helm): document the Helm repository now that charts.sim.ai serves

Held these back until the hostname actually resolved, because shipping an
install command that points at a dead domain is the exact failure this work
exists to remove. It resolves now: DNS is in place, GitHub Pages serves the
branch, and Let's Encrypt has issued the certificate.

Verified end to end rather than assumed:

  helm repo add sim https://charts.sim.ai
  helm repo update            # Successfully got an update

Presents OCI as the preferred path in both places and the repository as the
compatibility path, and says plainly that the signature and provenance are
attached to the OCI artifact only -- `helm repo add` has no equivalent, and
leaving that implicit would let someone believe they had verified something
they had not.

Bumps to 1.9.3 per the chart's own gate, since this touches helm/sim/.

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/kubernetes.mdx

@@ -22,8 +22,12 @@ import { FAQ } from '@/components/ui/faq'
 ## Installation
 
 The chart is published to GitHub Container Registry as an OCI artifact at
-`oci://ghcr.io/simstudioai/charts/sim`. Install it directly — no clone, and no
-`helm repo add`.
+`oci://ghcr.io/simstudioai/charts/sim`. Install it directly — no clone required.
+
+It is also available from a classic Helm repository at `https://charts.sim.ai`
+for tooling that expects one; see [Helm repository](#helm-repository) below.
+Prefer OCI where you can, since the signature and provenance are attached to the
+OCI artifact.
 
 ```bash
 # Generate secrets
@@ -36,7 +40,7 @@ POSTGRES_PASSWORD=$(openssl rand -hex 24)
 
 # Install
 helm install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.2 \
+  --version 1.9.3 \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
   --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
@@ -58,16 +62,36 @@ helm install sim oci://ghcr.io/simstudioai/charts/sim \
   This installs the chart's default image tag. For production, **pin `app`, `realtime`, and `migrations` to the same explicit release tag** — see [Upgrades](/platform/self-hosting/upgrades).
 </Callout>
 
+## Helm repository
+
+For clusters or GitOps configs that consume `helm repo add` rather than OCI:
+
+```bash
+helm repo add sim https://charts.sim.ai
+helm repo update
+
+helm install sim sim/sim --version 1.9.3 --namespace simstudio --create-namespace \
+  --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+  --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
+  --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
+  --set app.env.API_ENCRYPTION_KEY="$API_ENCRYPTION_KEY" \
+  --set app.env.CRON_SECRET="$CRON_SECRET" \
+  --set postgresql.auth.password="$POSTGRES_PASSWORD"
+```
+
+It serves the same chart as the OCI registry. The signature and provenance below
+apply to the OCI artifact only.
+
 ## Verifying the chart
 
 Every published version is signed with Sigstore keyless signing and carries a SLSA build-provenance attestation. Both live in the registry alongside the chart, so they survive a mirror into an internal registry.
 
 ```bash
-cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.2 \
+cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.3 \
   --certificate-identity-regexp '^https://github.com/simstudioai/sim/' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com
 
-gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.2 --repo simstudioai/sim
+gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.3 --repo simstudioai/sim
 ```
 
 Signing is Sigstore-only — there is no GPG `.prov` file, so `helm install --verify` does not apply.
@@ -88,7 +112,7 @@ SIM_RELEASE=v0.8.24
 curl -fsSLO "https://raw.githubusercontent.com/simstudioai/sim/$SIM_RELEASE/helm/sim/examples/values-aws.yaml"
 
 helm upgrade --install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.2 \
+  --version 1.9.3 \
   --values values-aws.yaml \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
@@ -209,7 +233,7 @@ kubectl port-forward deployment/sim-app 3000:3000 -n simstudio
 kubectl logs -l app.kubernetes.io/component=app -n simstudio --tail=100
 
 # Upgrade (always pin the target chart version)
-helm upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.2 --namespace simstudio
+helm upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.3 --namespace simstudio
 
 # Uninstall
 helm uninstall sim --namespace simstudio

helm/sim/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.9.2
+version: 1.9.3
 appVersion: "v0.8.18"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai

helm/sim/README.md

@@ -3,6 +3,7 @@
 Deploy [Sim](https://sim.ai) — the open-source AI workspace where teams build, deploy, and manage AI agents — on Kubernetes.
 
 * **Registry:** `oci://ghcr.io/simstudioai/charts/sim`
+* **Helm repository:** `https://charts.sim.ai`
 * **Chart version:** see `Chart.yaml`
 * **App version:** tracks the upstream Sim release
 * **Kubernetes:** 1.25+
@@ -22,7 +23,7 @@ export POSTGRES_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=')
 
 # Install from the registry
 helm install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.2 \
+  --version 1.9.3 \
   --namespace sim --create-namespace \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
@@ -106,10 +107,10 @@ immutable once published.
 
 ```bash
 # List the published versions
-helm show chart oci://ghcr.io/simstudioai/charts/sim --version 1.9.2
+helm show chart oci://ghcr.io/simstudioai/charts/sim --version 1.9.3
 
 helm install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.2 \
+  --version 1.9.3 \
   --namespace sim --create-namespace \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
@@ -126,13 +127,36 @@ To mirror the chart into an internal registry — the usual requirement for an
 air-gapped or internal-only cluster:
 
 ```bash
-helm pull oci://ghcr.io/simstudioai/charts/sim --version 1.9.2
-helm push sim-1.9.2.tgz oci://registry.internal.example.com/charts
+helm pull oci://ghcr.io/simstudioai/charts/sim --version 1.9.3
+helm push sim-1.9.3.tgz oci://registry.internal.example.com/charts
 ```
 
 The container images the chart references are listed in
 [`images.yaml`](./images.yaml); mirror those alongside it.
 
+### From the Helm repository
+
+The chart is also published to a classic Helm repository, for clusters and
+tooling that consume `helm repo add` rather than OCI.
+
+```bash
+helm repo add sim https://charts.sim.ai
+helm repo update
+
+helm install sim sim/sim \
+  --version 1.9.3 \
+  --namespace sim --create-namespace \
+  --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+  --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
+  --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
+  --set app.env.CRON_SECRET="$CRON_SECRET" \
+  --set postgresql.auth.password="$POSTGRES_PASSWORD"
+```
+
+Both paths serve the same chart. Prefer OCI where you can: the signature and
+provenance described in [Verifying the chart](#verifying-the-chart) are attached
+to the OCI artifact, and `helm repo add` has no equivalent.
+
 ### From a checkout
 
 ```bash
@@ -177,12 +201,12 @@ the registry next to the chart so they survive a mirror.
 
 ```bash
 # The signature: proves this chart was signed by a GitHub Actions run in this repo
-cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.2 \
+cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.3 \
   --certificate-identity-regexp '^https://github.com/simstudioai/sim/' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com
 
 # The provenance: proves which workflow, commit, and runner produced it
-gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.2 --repo simstudioai/sim
+gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.3 --repo simstudioai/sim
 ```
 
 There is no GPG `.prov` file — signing is Sigstore-only, so there is no