b0abaa2571
The PGP signing action ultimately just calls gpg with arguments set in https://github.com/actionhippie/gpgsign/blob/v1/overlay/usr/local/bin/entrypoint so its rather trivial to simply take the required arguments and put them directly in CI. This is substantially safer than the PGP signing action used as the action currently downloads, unverified and un-pinned, a docker image in order to access PGP. |
||
---|---|---|
.. | ||
ISSUE_TEMPLATE | ||
workflows | ||
dependabot.yml | ||
FUNDING.yml | ||
PULL_REQUEST_TEMPLATE.md | ||
SECURITY.md |