ci: Configure GoReleaser to sign the releases

.github/workflows/release.yml

@@ -131,6 +131,12 @@ jobs:
           DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         run: |
           echo "${DOCKER_PASSWORD}" | docker login --username "${DOCKER_USERNAME}" --password-stdin
+
+      - name: Import GPG key
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+        run: |
+          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
@@ -140,6 +146,11 @@ jobs:
           args: release --clean --timeout 60m
         env:
           GITHUB_TOKEN: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
+
+
 
   is-not-beta-release:
     name: check if release is a beta release

.goreleaser.yaml

@@ -775,3 +775,16 @@ scoops:
 
 snapshot:
   version_template: "{{ incpatch .Version }}-next"
+
+signs:
+  - artifacts: checksum
+    cmd: gpg
+    args: [
+      "--batch",
+      "--yes",
+      "--pinentry-mode", "loopback",
+      "--passphrase", "{{ .Env.GPG_PASSPHRASE }}",
+      "--local-user", "{{ .Env.GPG_KEY_ID }}",
+      "--output", "${signature}",
+      "--detach-sign", "${artifact}"
+    ]