Validate if tag signed before release

Make sure there is always signed tag before release.

.github/workflows/release.yml

@@ -22,6 +22,25 @@ jobs:
         with:
           fetch-depth: 0
 
+      -
+        name: GPG config
+        run: |
+          mkdir -p ~/.gnupg
+          cat << EOF >> ~/.gnupg/options
+          keyserver keys.openpgp.org
+          keyserver-options auto-key-retrieve
+          EOF
+
+      -
+        name: Verify tag signature
+        run: |
+          # NOTE: Solve the problem with Github action checkout https://github.com/actions/checkout/issues/290
+          git fetch --tags --force
+
+          version=${GITHUB_REF#refs/tags/*}
+          git show $version
+          git tag -v $version
+
       -
         name: Log into registry ${{ env.REGISTRY }}
         uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9

CHANGELOG.md

@@ -1,5 +1,7 @@
 # [Unreleased]
 
+* Verify git tag on release (#347, @miry)
+
 # [2.3.0] - 2021-12-23
 
 * Store all the executable `main` packages in `cmd` folder. (#335, @miry)

README.md

@@ -605,11 +605,9 @@ For example, `shopify_test_redis_master` or `shopify_development_mysql_1`.
 
 ### Release
 
-1. Ensure this release has run internally for `Shopify/shopify` for at least a
-   day which is the best fuzzy test for robustness we have.
 1. Update `CHANGELOG.md`
 1. Change versions in `README.md`
-1. Commit, Tag, and Push
+1. Create a commit, signed tag, and push
 1. [Bump version for Homebrew](https://github.com/Shopify/homebrew-shopify/blob/master/toxiproxy.rb#L9)
 
 [blog]: https://shopifyengineering.myshopify.com/blogs/engineering/building-and-testing-resilient-ruby-on-rails-applications