feat(GH-38): Sign tags (#39)

.github/workflows/release.yml

@@ -117,12 +117,16 @@ jobs:
         with:
           fetch-depth: 0
           fetch-tags: true
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.GH_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GH_GPG_PRIVATE_KEY_PASSWORD }}
+          git_user_signingkey: true
+          git_tag_gpgsign: true
       - name: Create and push tag
         run: |
-          git config user.name '${{ github.actor }}'
-          git config user.email '${{ github.actor }}@users.noreply.github.com'
-          git remote set-url origin https://${{ github.actor }}:${{ github.token }}@github.com/${{ github.repository }}
-          git tag -a ${{ env.tag }} -m "${{ env.tag }}}"
+          git tag -s ${{ env.tag }} -m "${{ env.tag }}}"
           git push origin tag ${{ env.tag }}
       - name: Generate changelog
         id: changelog