[DEV-387] Add GPG signing infrastructure for Homebrew tap trust

.github/pull_request_template.md

@@ -0,0 +1,47 @@
+## Description
+
+<!-- Describe your changes -->
+
+## Type of Change
+
+- [ ] Formula update (version bump)
+- [ ] New formula
+- [ ] Bug fix
+- [ ] Documentation update
+- [ ] Other (please describe):
+
+## Formula Details
+
+<!-- If updating a formula, provide details -->
+
+- Formula name:
+- New version:
+- Download URL:
+- SHA256 checksum:
+
+## Checklist
+
+- [ ] All commits are GPG-signed
+- [ ] Formula passes `brew audit --strict <formula>`
+- [ ] Formula installs successfully (`brew install <formula>`)
+- [ ] Tested on macOS (specify version):
+- [ ] Updated documentation if needed
+
+## GPG Signature Verification
+
+This tap requires GPG-signed commits for trust verification. Please ensure:
+
+- [ ] Your GPG key is configured in Git
+- [ ] All commits in this PR are signed
+- [ ] Your GPG public key is added to your GitHub account
+
+See [SIGNING.md](../SIGNING.md) for instructions on setting up GPG signing.
+
+To verify your commits are signed:
+```bash
+git log --show-signature
+```
+
+## Additional Notes
+
+<!-- Any additional information -->

.github/workflows-examples/README.md

@@ -0,0 +1,97 @@
+# GitHub Actions Workflow Examples
+
+This directory contains example GitHub Actions workflows for implementing GPG signing in this Homebrew tap.
+
+## Installation
+
+To enable these workflows, a repository administrator with appropriate permissions needs to:
+
+1. **Move workflows to the correct location**:
+   ```bash
+   mv .github/workflows-examples/*.yml .github/workflows/
+   ```
+
+2. **Configure GPG secrets** (see [BOT_SETUP.md](../../BOT_SETUP.md)):
+   - `BOT_GPG_PRIVATE_KEY` - The private GPG key for signing commits
+   - `BOT_GPG_PASSPHRASE` - The passphrase for the GPG key (if used)
+
+3. **Commit and push** the workflows:
+   ```bash
+   git add .github/workflows/
+   git commit -S -m "Enable GPG signing workflows"
+   git push
+   ```
+
+Note: Adding or modifying workflows requires a GitHub token with `workflow` scope.
+
+## Available Workflows
+
+### 1. `sign-commits.yml` - Sign Commits with GPG
+
+Manual workflow to sign existing commits with GPG.
+
+**Usage:**
+- Go to Actions > Sign Commits with GPG > Run workflow
+- Optionally specify a commit SHA to sign (defaults to HEAD)
+
+**What it does:**
+- Imports the GPG key from secrets
+- Amends the specified commit with a GPG signature
+- Force-pushes the signed commit
+
+### 2. `update-formula.yml` - Update Formula with GPG Signature
+
+Automates formula updates with GPG signing.
+
+**Usage:**
+- Go to Actions > Update Formula with GPG Signature > Run workflow
+- Provide: formula name, version, URL, and SHA256 checksum
+
+**What it does:**
+- Updates the specified formula file
+- Commits changes with GPG signature
+- Pushes to master branch
+- Verifies the signature
+
+### 3. `verify-signatures.yml` - Verify GPG Signatures
+
+Automatically verifies that all commits are GPG-signed.
+
+**When it runs:**
+- On pull requests to master/main
+- On pushes to master/main
+
+**What it does:**
+- Checks all commits for GPG signatures
+- Fails if any unsigned commits are found
+- Posts a comment on PRs with instructions if signatures are missing
+
+## Why These Are Examples
+
+These workflow files are provided as examples because:
+
+1. **Permission Requirements**: Adding or modifying GitHub Actions workflows requires a Personal Access Token with the `workflow` scope
+2. **Security**: Repository administrators should review and approve workflow changes
+3. **Customization**: Your organization may have different workflow requirements or security policies
+
+## Next Steps
+
+After enabling these workflows:
+
+1. Configure bot accounts with GPG keys (see [BOT_SETUP.md](../../BOT_SETUP.md))
+2. Add bot GPG fingerprints to `.trusted-keys`
+3. Test the workflows with a trial formula update
+4. Update your CI/CD pipelines to use the workflows or implement GPG signing
+
+## Manual Alternative
+
+If you prefer not to use GitHub Actions, you can implement GPG signing in your existing CI/CD system. See [BOT_SETUP.md](../../BOT_SETUP.md) for examples with:
+- Codefresh pipelines
+- Other CI/CD systems
+
+## Support
+
+For questions about implementing these workflows, see:
+- [SIGNING.md](../../SIGNING.md) - GPG signing setup
+- [BOT_SETUP.md](../../BOT_SETUP.md) - Bot account configuration
+- [CONTRIBUTING.md](../../CONTRIBUTING.md) - Contributing guidelines

.github/workflows-examples/sign-commits.yml

@@ -0,0 +1,67 @@
+name: Sign Commits with GPG
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit_sha:
+        description: 'Commit SHA to sign (leave empty for HEAD)'
+        required: false
+        type: string
+
+jobs:
+  sign-commit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.inputs.commit_sha || github.ref }}
+
+      - name: Import GPG key
+        id: import-gpg
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.BOT_GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+          git_tag_gpgsign: true
+          git_push_gpgsign: false
+
+      - name: Display GPG key info
+        run: |
+          echo "GPG key imported successfully"
+          echo "Key ID: ${{ steps.import-gpg.outputs.keyid }}"
+          echo "Fingerprint: ${{ steps.import-gpg.outputs.fingerprint }}"
+          gpg --list-keys
+
+      - name: Verify or create signed commit
+        run: |
+          # Check if the current commit is already signed
+          if git verify-commit HEAD 2>/dev/null; then
+            echo "✓ HEAD commit is already signed"
+            git log --show-signature -1
+          else
+            echo "⚠ HEAD commit is not signed"
+            echo "To sign existing commits, use: git rebase --exec 'git commit --amend --no-edit -n -S' -i <base-commit>"
+            echo "Note: This requires force-pushing and may disrupt users who have already cloned the repository"
+          fi
+
+      - name: Sign latest commit (amend)
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          # This will amend the latest commit with a GPG signature
+          git commit --amend --no-edit -S
+          echo "✓ Commit signed successfully"
+          git log --show-signature -1
+
+      - name: Push signed commit
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          # Force push the signed commit
+          git push --force-with-lease origin ${{ github.ref_name }}
+          echo "✓ Signed commit pushed to ${{ github.ref_name }}"

.github/workflows-examples/update-formula.yml

@@ -0,0 +1,89 @@
+name: Update Formula with GPG Signature
+
+on:
+  workflow_dispatch:
+    inputs:
+      formula:
+        description: 'Formula to update (cf2 or codefresh)'
+        required: true
+        type: choice
+        options:
+          - cf2
+          - codefresh
+      version:
+        description: 'New version'
+        required: true
+        type: string
+      url:
+        description: 'Download URL'
+        required: true
+        type: string
+      sha256:
+        description: 'SHA256 checksum'
+        required: true
+        type: string
+
+jobs:
+  update-formula:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.BOT_GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+
+      - name: Update formula
+        run: |
+          FORMULA_FILE="Formula/${{ github.event.inputs.formula }}.rb"
+
+          if [ ! -f "$FORMULA_FILE" ]; then
+            echo "Error: Formula file $FORMULA_FILE not found"
+            exit 1
+          fi
+
+          # Update version
+          sed -i "s|version \".*\"|version \"${{ github.event.inputs.version }}\"|g" "$FORMULA_FILE"
+
+          # Update URL
+          sed -i "s|url \".*\"|url \"${{ github.event.inputs.url }}\"|g" "$FORMULA_FILE"
+
+          # Update SHA256
+          sed -i "s|sha256 \".*\"|sha256 \"${{ github.event.inputs.sha256 }}\"|g" "$FORMULA_FILE"
+
+          echo "✓ Updated $FORMULA_FILE"
+          cat "$FORMULA_FILE"
+
+      - name: Commit changes with GPG signature
+        run: |
+          git config user.name "codefresh-bot"
+          git config user.email "bot@codefresh.io"
+
+          git add Formula/${{ github.event.inputs.formula }}.rb
+          git commit -S -m "update formula ${{ github.event.inputs.formula }} to version ${{ github.event.inputs.version }}"
+
+          echo "✓ Changes committed with GPG signature"
+          git log --show-signature -1
+
+      - name: Push changes
+        run: |
+          git push origin master
+          echo "✓ Changes pushed to master"
+
+      - name: Verify commit signature
+        run: |
+          if git verify-commit HEAD; then
+            echo "✓ Commit signature verified successfully"
+          else
+            echo "⚠ Warning: Commit signature verification failed"
+            exit 1
+          fi