INFRA-92: add commit signing (#13)

* add commit signing

* fix missing flag

* add missing secrets to check vars

* fix linting

.github/workflows/_check-vars-and-secrets.yml

@@ -29,6 +29,8 @@ jobs:
             -z '${{ secrets.AWS_MAINNET_SECRET_ACCESS_KEY }}' || \
             -z '${{ secrets.AUTOCOMMIT_AUTHOR }}' || \
             -z '${{ secrets.AUTOCOMMIT_EMAIL }}' || \
+            -z '${{ secrets.AUTOCOMMIT_GPG_KEY_B64 }}' || \
+            -z '${{ secrets.AUTOCOMMIT_GPG_KEY_FINGERPRINT }}' || \
             -z '${{ secrets.CI_GH_TOKEN }}' || \
             -z '${{ secrets.REPO_ARGOCD_APPS_NAME }}'
           ]]; then

.github/workflows/deploy-to-devnet.yml

@@ -72,11 +72,21 @@ jobs:
             cd ${aleph_path}/${apps_name}/faucet/overlays/devnet/${{ env.REGIONS_AWS }}
             kustomize edit set image "faucet-image-placeholder=${{ env.RELEASE_IMAGE }}"
 
+      - name: Configure signing key
+        # yamllint disable rule:line-length
+        run: |
+          echo ${{ secrets.AUTOCOMMIT_GPG_KEY_B64 }} | base64 -d > key.gpg
+          gpg --import key.gpg
+          rm key.gpg
+          git config --global user.signingkey $(echo ${{ secrets.AUTOCOMMIT_GPG_KEY_FINGERPRINT }} | tail -c 17)
+        # yamllint enable rule:line-length
+
       - name: GIT | Commit changes to argocd apps repository.
         uses: EndBug/[email protected]
         with:
           author_name: ${{ secrets.AUTOCOMMIT_AUTHOR }}
           author_email: ${{ secrets.AUTOCOMMIT_EMAIL }}
+          commit: "-S"
           # yamllint disable-line rule:line-length
           message: "Updating devnet faucet docker image tag to: ${{ steps.get-image-name.outputs.image }}"
           add: "*.yaml"

.github/workflows/deploy-to-testnet.yml

@@ -72,11 +72,21 @@ jobs:
             cd ${aleph_path}/${apps_name}/faucet/overlays/testnet/${{ env.REGIONS_AWS }}
             kustomize edit set image "faucet-image-placeholder=${{ env.RELEASE_IMAGE }}"
 
+      - name: Configure signing key
+        # yamllint disable rule:line-length
+        run: |
+          echo ${{ secrets.AUTOCOMMIT_GPG_KEY_B64 }} | base64 -d > key.gpg
+          gpg --import key.gpg
+          rm key.gpg
+          git config --global user.signingkey $(echo ${{ secrets.AUTOCOMMIT_GPG_KEY_FINGERPRINT }} | tail -c 17)
+        # yamllint enble rule:line-length
+
       - name: GIT | Commit changes to argocd apps repository.
         uses: EndBug/[email protected]
         with:
           author_name: ${{ secrets.AUTOCOMMIT_AUTHOR }}
           author_email: ${{ secrets.AUTOCOMMIT_EMAIL }}
+          commit: -S
           # yamllint disable-line rule:line-length
           message: "Updating testnet faucet docker image tag to: ${{ steps.get-image-name.outputs.image }}"
           add: "*.yaml"