ci: sign RPM packages during release

.github/workflows/release.yaml

@@ -15,16 +15,27 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Write RPM signing key
+        env:
+          RPM_SIGNING_KEY: ${{ secrets.RPM_SIGNING_KEY }}
+        run: |
+          set -euo pipefail
+          test -n "$RPM_SIGNING_KEY"
+          umask 077
+          printf '%s\n' "$RPM_SIGNING_KEY" > "$RUNNER_TEMP/rpm-signing-key.asc"
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           distribution: goreleaser
-          version: '~> v2'
+          version: v2.16.0
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GPG_KEY_PATH: ${{ runner.temp }}/rpm-signing-key.asc
+          NFPM_PASSPHRASE: ${{ secrets.NFPM_PASSPHRASE }}

.goreleaser.yaml

@@ -50,10 +50,11 @@ nfpms:
     package_name: nmcli-cli
     file_name_template: "{{ .ConventionalFileName }}"
     description: |-
-      nmcli-cli is a fast updater for ipset IP sets
+      nmcli-cli is a command-line tool that simplifies the use of 'nmcli'.
     maintainer: Jun Futagawa <jfut@integ.jp>
     license: MIT
     vendor: nmcli-cli project
+    homepage: https://github.com/jfut/nmcli-cli
     bindir: /usr/bin
     section: utils
     formats:
@@ -62,6 +63,9 @@ nfpms:
       - rpm
       - termux.deb
       - archlinux
+    rpm:
+      signature:
+        key_file: '{{ with index .Env "GPG_KEY_PATH" }}{{ . }}{{ end }}'
     contents:
       - src: nmcli-cli-*
         dst: /usr/bin/

README.md

@@ -959,6 +959,8 @@ nmcli connection delete bond1
 
 ## Release
 
+GitHub Actions signs RPM artifacts with the GPG private key stored in `RPM_SIGNING_KEY`. If the key has a passphrase, store it in `NFPM_PASSPHRASE`.
+
 1. Run `git tag -s vX.Y.Z -m vX.Y.Z`.
 2. Run `git push origin vX.Y.Z` and wait for the Release to be created.
 3. Edit the created Release.