From 2fced8fb890a12fc12c3299bb516118e20866d8f Mon Sep 17 00:00:00 2001
From: Oliver Hamlet <git@ortham.net>
Date: Thu, 8 May 2025 16:18:58 +0100
Subject: [PATCH] Sign CI archives

---
 .github/workflows/ci.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 63b19461..25e98b0c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -185,9 +185,20 @@ jobs:
 
           echo "filename=libloot-${VERSION}-${PLATFORM}.${EXTENSION}" >> $GITHUB_OUTPUT
 
+      - name: Import GPG key
+        run: echo -n "${{ secrets.GPG_SIGNING_KEY }}" | gpg --import
+        if: github.event_name == 'push'
+
+      - name: Sign archive
+        working-directory: cpp/build/package
+        run: gpg --output "${{ steps.archive-name.outputs.filename }}.sig" --detach-sig "${{ steps.archive-name.outputs.filename }}"
+        if: github.event_name == 'push'
+
       - name: Upload archive
         uses: actions/upload-artifact@v4
         with:
           name: ${{ steps.archive-name.outputs.filename }}
-          path: cpp/build/package/${{ steps.archive-name.outputs.filename }}
+          path: |
+            cpp/build/package/${{ steps.archive-name.outputs.filename }}
+            cpp/build/package/${{ steps.archive-name.outputs.filename }}.sig
         if: github.event_name == 'push'