Add an option to gh release create for signing files attached to the release

[sschuberth]

Describe the feature or problem you’d like to solve

In order to pass this OpenSSF Scorecard check, it would be great if any files passed to gh release create could optionally get cryptographically signed with a configurable key.

Proposed solution

Add a command line option to gh release create that takes a key file (and / or GitHub secret when running inside a GitHub action) to automatically sign any uploaded files and upload the respective signature files along with it.

Additional context

Maybe also the new gh attestation command could be extended instead to sign existing releases, making this a two-step-process of first creating the release and signing its artifacts. However, that would defeat the convenience purpose a bit to not run gpg manually for all artifacts, but let gh release create do all the work.

[andyfeller]

Thanks for opening up this suggestion, @sschuberth! ❤

While reading through this, I was also wondering whether the actions/attest-build-provenance action used for generating these release attestation artifacts might be leveraged for this concern. Given that this is only supported as a GitHub Action, I want to defer to my @cli/package-security colleagues to speak to potential concerns with generating and signing these attestations outside of GitHub Actions.

[steiza]

Great question @sschuberth!

As it happens, we are planning on integrating artifact attestations with releases, after we take artifact attestations through public beta and into general availability. Thanks for the feedback, and stay tuned.