INFRA-92: add signing commits to workflows and actions (#58)

* add signing commits to workflows and actions

* add secrets to checks

.github/workflows/_branchpreview-create.yml

@@ -63,6 +63,8 @@ jobs:
           argo-sync-user-token: ${{ secrets.ARGO_SYNC_USER_TOKEN }}
           git-commit-author: ${{ secrets.AUTOCOMMIT_AUTHOR }}
           git-commit-email: ${{ secrets.AUTOCOMMIT_EMAIL }}
+          git-commit-gpg-key-b64: ${{ secrets.AUTOCOMMIT_GPG_KEY_B64 }}
+          git-commit-gpg-key-fingerprint: ${{ secrets.AUTOCOMMIT_GPG_KEY_FINGERPRINT }}
           hard-refresh: 'true'
           post-frontend-url: '${{ inputs.post-frontend-url }}'
           pull-request-number: '${{ inputs.pull-request-number }}'

.github/workflows/_branchpreview-delete.yml

@@ -36,3 +36,5 @@ jobs:
           argo-sync-user-token: ${{ secrets.ARGO_SYNC_USER_TOKEN }}
           git-commit-author: ${{ secrets.AUTOCOMMIT_AUTHOR }}
           git-commit-email: ${{ secrets.AUTOCOMMIT_EMAIL }}
+          git-commit-gpg-key-b64: ${{ secrets.AUTOCOMMIT_GPG_KEY_B64 }}
+          git-commit-gpg-key-fingerprint: ${{ secrets.AUTOCOMMIT_GPG_KEY_FINGERPRINT }}

.github/workflows/_check-vars-and-secrets.yml

@@ -33,6 +33,8 @@ jobs:
             -z '${{ secrets.AWS_DEVNET_SECRET_ACCESS_KEY }}' || \
             -z '${{ secrets.AUTOCOMMIT_AUTHOR }}' || \
             -z '${{ secrets.AUTOCOMMIT_EMAIL }}' || \
+            -z '${{ secrets.AUTOCOMMIT_GPG_KEY_B64 }}' || \
+            -z '${{ secrets.AUTOCOMMIT_GPG_KEY_FINGERPRINT }}' || \
             -z '${{ secrets.CI_DEVNET_S3BUCKET_NAME }}' || \
             -z '${{ secrets.CI_GH_USER }}' || \
             -z '${{ secrets.CI_GH_TOKEN }}' || \

create-branchpreview/action.yml

@@ -29,6 +29,12 @@ inputs:
   git-commit-email:
     description: 'Git commit email when pushing to branchpreviews repository'
     required: true
+  git-commit-gpg-key-b64:
+    description: base64 encoded signing key
+    required: true
+  git-commit-gpg-key-fingerprint:
+    description: fingerprint of gpg key
+    required: true
   image:
     description: 'Full docker image in format of host/repo:tag'
     required: true
@@ -118,11 +124,22 @@ runs:
         echo "all-base64=${all_base64}" >> $GITHUB_OUTPUT
       # yamllint enable rule:line-length
 
+    - name: Configure signing key
+      shell: bash
+      # yamllint disable rule:line-length
+      run: |
+        echo ${{ inputs.git-commit-gpg-key-b64 }} | base64 -d > key.gpg
+        gpg --import key.gpg
+        rm key.gpg
+        git config --global user.signingkey $(echo ${{ inputs.git-commit-gpg-key-fingerprint }} | tail -c 17)
+      # yamllint enable rule:line-length
+
     - name: Commit branchpreview change
       uses: EndBug/[email protected]
       with:
         author_name: '${{ inputs.git-commit-author }}'
         author_email: '${{ inputs.git-commit-email }}'
+        commit: -S
         # yamllint disable-line rule:line-length
         message: 'Upsert ${{ inputs.repository-name }}:${{ inputs.branch-name }} with image tag: ${{ steps.start-branchpreview.outputs.image-tag }}'
         add: '["*.yaml","*.txt"]'

delete-branchpreview/action.yml

@@ -30,6 +30,12 @@ inputs:
   git-commit-email:
     description: 'Git commit email when pushing to branchpreviews repository'
     required: true
+  git-commit-gpg-key-b64:
+    description: base64 encoded signing key
+    required: true
+  git-commit-gpg-key-fingerprint:
+    description: fingerprint of gpg key
+    required: true
 
 runs:
   using: "composite"
@@ -79,6 +85,16 @@ runs:
           '${{ inputs.repository-name }}' \
           '${{ inputs.branch-name }}'
 
+    - name: Configure signing key
+      shell: bash
+      # yamllint disable rule:line-length
+      run: |
+        echo ${{ inputs.git-commit-gpg-key-b64 }} | base64 -d > key.gpg
+        gpg --import key.gpg
+        rm key.gpg
+        git config --global user.signingkey $(echo ${{ inputs.git-commit-gpg-key-fingerprint }} | tail -c 17)
+      # yamllint enable rule:line-length
+
     - name: Commit deletion of the branchpreview
       uses: EndBug/[email protected]
       with: