chore: use GPG for signing release

.github/workflows/release.yaml

@@ -1,21 +1,27 @@
 ---
-name: 'Release'
+name: "Release"
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
 jobs:
   goreleaser:
-    runs-on: 'ubuntu-latest'
+    runs-on: "ubuntu-latest"
     permissions:
       contents: "write"
     steps:
-      - uses: 'actions/checkout@v4'
+      - uses: "actions/checkout@v4"
         with:
           fetch-depth: 0
-      - uses: 'actions/setup-go@v5'
-      - uses: 'goreleaser/goreleaser-action@v6'
+      - name: "Import GPG key"
+        id: "import_gpg"
+        uses: "crazy-max/ghaction-import-gpg@v6"
         with:
-          args: 'release --clean'
+          gpg_private_key: "${{ secrets.GPG_PRIVATE_KEY }}"
+      - uses: "actions/setup-go@v5"
+      - uses: "goreleaser/goreleaser-action@v6"
+        with:
+          args: "release --clean"
         env:
-          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GPG_FINGERPRINT: "${{ steps.import_gpg.outputs.fingerprint }}"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.goreleaser.yaml

@@ -8,4 +8,4 @@ builds:
   - skip: true
 
 changelog:
-  use: github
+  use: "github"