release: create source tarball and sign all artifacts

.github/workflows/release.yml

@@ -20,6 +20,16 @@ jobs:
 
       - uses: ./.github/actions/build
 
+      - name: Import GPG key
+        # This is a third-party GitHub action and we trust it with our GPG key.
+        # To be on the safer side, we should always pin to the commit SHA.
+        # It's not a perfect mitigation, but we should always do some due diligence before upgrading.
+        # The author seems trustworthy, as the author is part of the docker and goreleaser organizations on GitHub.
+        uses: crazy-max/ghaction-import-gpg@72b6676b71ab476b77e676928516f6982eef7a41
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+
       - uses: ./go.mk/.github/actions/release
         with:
           release_github_token: ${{ secrets.RELEASE_GITHUB_TOKEN }}

.goreleaser.yml

@@ -98,3 +98,16 @@ dockers:
       - --build-arg="VERSION={{.Version}}"
       - --build-arg="VCS_REF={{.ShortCommit}}"
       - --build-arg="BUILD_DATE={{.Date}}"
+
+source:
+  enabled: true
+  prefix_template: "{{ .ProjectName }}_{{ .Version }}/"
+  name_template: "{{ .ProjectName }}_{{ .Version }}"
+  rlcp: true
+  files:
+    - go.mk/*
+
+signs:
+- cmd: gpg
+  args: ["--default-key", "7100E8BFD6199CE0374CB7F003686F8CDE378D41", "--detach-sign", "${artifact}"]
+  artifacts: all

CHANGELOG.md

@@ -6,6 +6,10 @@
 
 - compute instance: implement reset-password command #536
 
+### Improvements
+
+- release: create source tarball and sign all artifacts #538
+
 ## 1.72.2
 
 ### Improvements