Sign produced artifacts directly with gpg

rabbitmq · Nov 12, 2024 · 1d5bc9e · 1d5bc9e
1 parent 50b3ab6
commit 1d5bc9e
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/.github/workflows/reusable-release-workflow.yml b/.github/workflows/reusable-release-workflow.yml
@@ -232,6 +232,12 @@ jobs:
                             SIGNING_KEY=${{ secrets.GPG_SIGNING_KEY_ID }}
           cd ..
           ls -lha PACKAGES/
+          for file in PACKAGES; do
+            if test -f "$file"; then
+              gpg --default-key "${{ env.GPG_SIGNING_KEY_ID }}" --detach-sign --armor "$file"
+            end
+          end
+          ls -lha PACKAGES/
       - name: Build Debian package without GPG signing
         if: inputs.gpg_sign_release == false
         run: |
@@ -322,6 +328,12 @@ jobs:
                                   SIGNING_KEY="${{ secrets.GPG_SIGNING_KEY_ID }}"
           cd ..
           ls -lha PACKAGES/
+          for file in PACKAGES; do
+            if test -f "$file"; then
+              gpg --default-key "${{ env.GPG_SIGNING_KEY_ID }}" --detach-sign --armor "$file"
+            end
+          end
+          ls -lha PACKAGES/
       - name: Build RPM package without GPG signing
         if: inputs.gpg_sign_release == false
         run: |