ci: (re)enable releasing via GitHub Action workflow

[radeksimko]

This follows a guide in https://github.com/hashicorp/signore/blob/main/docs/SIGNING_GIT_COMMITS.md and https://github.com/hashicorp/signore/blob/main/docs/SIGNING_IN_CI.md

TODO

• register new bot GitHub account for holding new GPG key
• update script to use new email
• get a new signore signer
• upload new pubkey to the bot GitHub account
• ensure the correct SIGNORE_SIGNER is set
• ensure the correct SIGNORE_CLIENT & SIGNORE_SECRET are set
• Add release instructions to CONTRIBUTING.md

[dbanck]

LGTM 👍

I assume using git commit --gpg-sign="${SIGNORE_SIGNER}", removes the need to update the git config like outlined in the signore docs:

git config --global user.signingkey $your_signore_signer
git config --global commit.gpgsign true

[radeksimko]

I assume using git commit --gpg-sign="${SIGNORE_SIGNER}", removes the need to update the git config like outlined in the signore docs:

Yes, that is my understanding as well. The git config options would mean "always sign every commit/tag", whereas we're just being more explicit there by passing the flags to git commit and git tag.