[FEAT]: 🎉 Add Support for GPG Signing

[adam-grant-hendry]

Currently, this action doesn't support gpg signing commits and tags. This could be added simply by modifying the entrypoint.sh script to accept a gpg passphrase and key that have been added as SECRETS to the repo.

[adam-grant-hendry]

See commitizen Discussions #616. commitizen-action builds and runs inside a Docker container, which prevents using actions like import-gpg since that runs and sets up gpg in the local runner.

One of the two will have to be performed:

1. Find a way to run a GitHub Action like import-gpg within the built Docker container
2. Amend our entrypoint.sh script with code like in action-gpg

Currently, using import-gpg and copy-pasting and running entrypoint.sh directly in a GitHub workflow works (slightly modified, of course).

I found action-gpg to have a couple problems (firstly, this), but it could probably work with the right tweaking.

import-gpg uses TypeScript, which I am only vaguely familiar with at this point, so I'm not able to convert it into a shell script.

[suasuasuasuasua]

Hey! I had a question about the workarounds. I have a workflow pretty similar to #72 using crazy-max/ghaction-import-gpg@v6. I'm getting an error where there isn't a secret key found by GPG. I used the name and email output from the import-gpg step, so they are definitely matching.

gpg (GnuPG) 2.4.7
libgcrypt 1.10.3
Copyright (C) 2024 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Home: /github/home/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
git version 2.47.1
Configuring Git username, email, and pull behavior...
Git name: github-actions[bot]
Git email: github-actions@users.noreply.github.com
pip install commitizen
...
Commitizen version: 4.1.0
cz --debug --no-raise 21 bump --yes --gpg-sign --changelog --git-output-to-stderr --changelog-to-stdout >body.md
bump: version 0.1.1 → 0.1.2
tag to create: 0.1.2
increment detected: PATCH
[main b66d848] bump: version 0.1.1 → 0.1.2
 2 files changed, 7 insertions(+), 1 deletion(-)
error: gpg failed to sign the data:
gpg: directory '/github/home/.gnupg' created
gpg: skipped "github-actions[bot] <github-actions@users.noreply.github.com>": No secret key
[GNUPG:] INV_SGNR 9 github-actions[bot] <github-actions@users.noreply.github.com>
[GNUPG:] FAILURE sign 17
gpg: signing failed: No secret key
error: unable to sign the tag
The tag message has been left in .git/TAG_EDITMSG
Traceback (most recent call last):
  File "/usr/local/bin/cz", line 8, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.10/site-packages/commitizen/cli.py", line 651, in main
    args.func(conf, arguments)()
  File "/usr/local/lib/python3.10/site-packages/commitizen/commands/bump.py", line 400, in __call__
    raise BumpTagFailedError(c.err)
commitizen.exceptions.BumpTagFailedError: error: gpg failed to sign the data:
gpg: directory '/github/home/.gnupg' created
gpg: skipped "github-actions[bot] <github-actions@users.noreply.github.com>": No secret key
[GNUPG:] INV_SGNR 9 github-actions[bot] <github-actions@users.noreply.github.com>
[GNUPG:] FAILURE sign 17
gpg: signing failed: No secret key
error: unable to sign the tag
The tag message has been left in .git/TAG_EDITMSG

Could you explain the workaround?