build: test signing

.github/workflows/pypi-build.yaml → .github/workflows/publish.yaml

@@ -1,4 +1,4 @@
-name: Python Package
+name: Publish
 
 on:
   push:
@@ -29,22 +29,19 @@ jobs:
           if-no-files-found: error
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
 
-  publish:
+  pypi:
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     environment: release
+    permissions:
+      id-token: write
     needs: build
     steps:
-      - name: Install poetry
-        run: pipx install poetry
-
       - uses: actions/download-artifact@v4
         with:
           name: package
 
       - run: ls dist/*
 
-      - name: Publish package
-        run: poetry publish
-        env:
-          POETRY_PYPI_TOKEN_PYPI: ${{ secrets.PYPI_TOKEN }}
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/sign-commit.yaml

@@ -0,0 +1,36 @@
+on:
+  push:
+    branches:
+      - test-commit-signing
+
+jobs:
+  sign-commit:
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - name: Check out
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@v6
+        id: gpg-import
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+          git_tag_gpgsign: true
+          fingerprint: 2B939A343491740FE1483E5C41E311388E4BB349
+
+      - name: List keys
+        run: gpg -K
+
+      - run: |
+          echo "Hello there" | tee change.file
+          git add change.file
+          git commit -m "changed a file"
+
+      - name: Verify commit signature
+        run: git verify-commit HEAD