feat(release): sign commits created by release actor

.github/workflows/conventional-commit-release.yaml

@@ -88,7 +88,13 @@ on:
         value: ${{ jobs.release.outputs.major_tag }}
     secrets:
       RELEASE_TOKEN:
-        description: Github PAT used for executing the release-please action. Only required for default branch builds.
+        description: Github PAT used for executing the release-please action. Only required on push events to the default branch.
+        required: false
+      RELEASE_ACTOR_GPG_PRIVATE_KEY:
+        description: GPG Private key associated with the release actor. Used to ensure that commits are signed. Only required on push events to the default branch.
+        required: false
+      RELEASE_ACTOR_GPG_PASSPHRASE:
+        description: Passphrase to unlock the use the GPG Key passed in `RELEASE_ACTOR_GPG_PRIVATE_KEY`. Used to ensure that commits are signed. Only required on push events to the default branch.
         required: false
 
 permissions:
@@ -231,6 +237,34 @@ jobs:
           extra-files: ${{ inputs.extra_files }}
           token: ${{ secrets.RELEASE_TOKEN }}
 
+
+      - name: Checkout Release Branch
+        if: ${{ steps.release.outputs.pr != '' }}
+        id: checkout-release-branch
+        uses: actions/[email protected]
+        with:
+          ref: ${{ fromJson(steps.release.outputs.pr).headBranchName }}
+          fetch-depth: 0
+
+      - name: Import GPG key
+        id: key-import
+        if: ${{ steps.checkout-release-branch.conclusion == 'success' }}
+        uses: crazy-max/[email protected]
+        with:
+          gpg_private_key: ${{ secrets.RELEASE_ACTOR_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.RELEASE_ACTOR_GPG_PASSPHRASE }}
+          git_config_global: true
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+
+      - name: Amend the PR commit to sign it
+        if: ${{ steps.key-import.conclusion == 'success' }}
+        run: |-
+          git config --global user.name "${{ steps.key-import.outputs.name }}"
+          git config --global user.email "${{ steps.key-import.outputs.email }}"
+          git commit --amend --no-edit -S
+          git push --force
+
       - name: Create additional tags
         if: steps.release.outputs.release_created
         id: additional_tags