Update action.yml

[JuckZ]

Locally sign a public GPG key in the context of the Pacman.

[boredland]

I guess that makes sense, but how did this even work without it?

[JuckZ]

If you only run sudo pacman-key --keyserver keys.openpgp.org --recv-key xxx without following it with sudo pacman-key --lsign-key xxx, you will successfully import the public key into your local keyring but it will not be marked as "trusted." As a result, if you try to install a package that is signed with this key, Pacman will reject it, producing an "unknown trust" or similar error message.

[boredland]

If you only run sudo pacman-key --keyserver keys.openpgp.org --recv-key xxx without following it with sudo pacman-key --lsign-key xxx, you will successfully import the public key into your local keyring but it will not be marked as "trusted." As a result, if you try to install a package that is signed with this key, Pacman will reject it, producing an "unknown trust" or similar error message.

Ah, that makes sense! Thanks for the explanation!

[boredland]

I am not sure why the test-build fails. Will have to look later...