ci: sign releases with gpg

lindell · Nov 4, 2023 · 29a9a1e · 29a9a1e
1 parent adf5f18
commit 29a9a1e
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -34,6 +34,11 @@ jobs:
           go-version-file: "go.mod"
         if: ${{ steps.release.outputs.release_created }}
 
+      - name: Import GPG key for signing
+        run: echo "${GPG_PRIVATE_KEY}" | gpg --import
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v2
         with:
@@ -42,6 +47,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GENERAL_GITHUB_SECRET }} # The tokens needs access to another repo, so the secret.GITHUB_SECRET won't suffice
           FURY_TOKEN: ${{ secrets.FURY_TOKEN }} # Gemfury token
+          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }} # Fingerprint of GPG signing key
         if: ${{ steps.release.outputs.release_created }}
 
       - name: Comment on prs and issues

diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -86,3 +86,6 @@ publishers:
       - packages
     dir: "{{ dir .ArtifactPath }}"
     cmd: curl -F package=@{{ .ArtifactName }} https://{{ .Env.FURY_TOKEN }}@push.fury.io/multi-gitter/
+signs:
+  - artifacts: checksum
+    args: ["--batch", "-u", "{{ .Env.GPG_FINGERPRINT }}", "--output", "${signature}", "--detach-sign", "${artifact}"]