gha: add GPG-signed tags to release workflow

Align with bcvk release flow: use GPG key import for git
identity and signed tags, pass app token to checkout instead
of manually setting the remote URL.

Requires GPG_PRIVATE_KEY and GPG_PASSPHRASE secrets.

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>

Author: alicefr

.github/workflows/release.yaml

@@ -28,13 +28,21 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          permission-contents: write
 
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-          persist-credentials: false
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+          git_tag_gpgsign: true
 
       - name: Extract version
         id: version
@@ -50,16 +58,13 @@ jobs:
       - name: Create and push tag
         env:
           TAG: ${{ steps.version.outputs.tag }}
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           if git rev-parse "${TAG}" >/dev/null 2>&1; then
             echo "::error::Tag ${TAG} already exists"
             exit 1
           fi
-          git tag -a -m "Release ${TAG}" "${TAG}"
-          git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git tag -s -m "Release ${TAG}" "${TAG}"
           git push origin "${TAG}"
-          git remote set-url origin "https://github.com/${GITHUB_REPOSITORY}.git"
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0