ci(signed-commits): use GPG signing (#13069)

(cherry picked from commit 64ec9d5)
elastic · May 7, 2024 · 8f6b7a4 · 8f6b7a4
1 parent 9689a72
commit 8f6b7a4
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 5 deletions.
diff --git a/.github/workflows/run-minor-release.yml b/.github/workflows/run-minor-release.yml
@@ -71,10 +71,16 @@ jobs:
       - name: Configure git user
         uses: elastic/apm-pipeline-library/.github/actions/setup-git@current
         with:
-          username: ${{ env.GIT_USER }}
-          email: ${{ env.GIT_EMAIL }}
           token: ${{ env.GH_TOKEN }}
 
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4  # v6.1.0
+        with:
+          gpg_private_key: ${{ secrets.APM_SERVER_RELEASE_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.APM_SERVER_RELEASE_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+
       - run: make minor-release
 
       - uses: elastic/apm-pipeline-library/.github/actions/slack-message@current

diff --git a/.github/workflows/run-patch-release.yml b/.github/workflows/run-patch-release.yml
@@ -62,10 +62,17 @@ jobs:
       - name: Configure git user
         uses: elastic/apm-pipeline-library/.github/actions/setup-git@current
         with:
-          username: ${{ env.GIT_USER }}
-          email: ${{ env.GIT_EMAIL }}
           token: ${{ env.GH_TOKEN }}
 
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4  # v6.1.0
+        with:
+          gpg_private_key: ${{ secrets.APM_SERVER_RELEASE_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.APM_SERVER_RELEASE_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+          git_push_gpgsign: true
+
       - run: make patch-release
 
       - uses: elastic/apm-pipeline-library/.github/actions/slack-message@current

diff --git a/release.mk b/release.mk
@@ -256,7 +256,7 @@ create-commit:
 	if [ ! -z "$$(git status -s)" ]; then \
 		git status -s; \
 		git add --all; \
-		git commit -a -m "$(COMMIT_MESSAGE)"; \
+		git commit --gpg-sign -a -m "$(COMMIT_MESSAGE)"; \
 	fi
 	@echo "::endgroup::"