From 7a9fccb842d4b23aa0ad2ac19e67b5ed28042ed2 Mon Sep 17 00:00:00 2001
From: silverwind <2021+silverwind@noreply.gitea.com>
Date: Thu, 5 Nov 2026 04:28:22 +0000
Subject: [PATCH] ci: sign release checksums with the imported GPG key (#1382)

The release job has imported the Teabot GPG key since https://gitea.com/gitea/runner/pulls/116, but `.goreleaser.yaml` never had a `signs:` block, so releases were never signed. Add it so `checksums.txt` gets a detached `checksums.txt.sig`, the same way https://gitea.com/gitea/cli signs its releases.

The nightly job imports the key as well since the `signs:` block applies to nightly builds, and the R2 publisher mirrors the signature to dl.gitea.com.

_Written by Claude (Opus 5.5)._

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1382
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 .gitea/workflows/release-nightly.yml | 8 ++++++++
 .goreleaser.yaml                     | 5 +++++
 2 files changed, 13 insertions(+)

diff --git a/.gitea/workflows/release-nightly.yml b/.gitea/workflows/release-nightly.yml
index 9cce9014..3cfc84f8 100644
--- a/.gitea/workflows/release-nightly.yml
+++ b/.gitea/workflows/release-nightly.yml
@@ -34,6 +34,13 @@ jobs:
         with:
           go-version-file: "go.mod"
           check-latest: true
+      - name: Import GPG key
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.PASSPHRASE }}
+          fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
       - name: goreleaser
         uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7
         with:
@@ -47,6 +54,7 @@ jobs:
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: "gitea"
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
 
   release-image:
     runs-on: ubuntu-latest
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index cc3f6ab7..50c225a7 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -80,6 +80,7 @@ builds:
 publishers:
   - name: cloudflare-r2
     checksum: true
+    signature: true
     extra_files:
       - glob: ./**.xz
       - glob: ./**.sha256
@@ -100,6 +101,10 @@ checksum:
   extra_files:
       - glob: ./**.xz
 
+signs:
+  - artifacts: checksum
+    args: ["--batch", "-u", "{{ .Env.GPG_FINGERPRINT }}", "--output", "${signature}", "--detach-sign", "${artifact}"]
+
 snapshot:
   version_template: "{{ .Branch }}-devel"