[DEV-387] Add GPG signing infrastructure for Homebrew tap trust

[YairLeshemOctopus]

Linear issue: https://linear.app/octopus/issue/DEV-387/codefresh-io-cli-tap-is-not-trusted-in-homebrew

Summary

This PR implements GPG signing infrastructure to make the Homebrew tap trusted. Starting with Homebrew 5.2.0/6.0.0, tap trust verification will become mandatory by default.

Problem

Homebrew currently shows this warning:

Warning: The following taps are not trusted:
  codefresh-io/cli

Homebrew will ignore formulae, casks and commands from these taps when HOMEBREW_REQUIRE_TAP_TRUST is set.
This will become the default in Homebrew 6.0.0 or 5.2.0, whichever comes first.

Solution

This PR adds comprehensive GPG signing infrastructure including:

Documentation

• SIGNING.md - Complete guide for setting up GPG signing for maintainers and users
• BOT_SETUP.md - Detailed instructions for configuring bot accounts (codefresh-git-integration[bot], cf-ci-bot-v2) with GPG keys
• CONTRIBUTING.md - Contributing guidelines with GPG signing requirements
• Updated README.md - Added tap trust information and user instructions

Infrastructure

• .trusted-keys - File to track authorized GPG key fingerprints
• verify-signatures.sh - Script to verify commit signatures locally
• PR template - Includes GPG signing checklist for contributors

GitHub Actions Workflows (Examples)

Located in .github/workflows-examples/ (requires token with 'workflow' scope to activate):

• sign-commits.yml - Manual workflow to sign existing commits
• update-formula.yml - Automated formula updates with GPG signing
• verify-signatures.yml - CI check to verify all commits are signed

Implementation Notes

Why Workflows Are Examples

The workflow files are in .github/workflows-examples/ because:

1. Adding/modifying workflows requires a GitHub token with workflow scope
2. Repository administrators should review workflow changes for security
3. Organizations may have different workflow requirements

See .github/workflows-examples/README.md for activation instructions.

Next Steps for Maintainers

1. Review and approve this PR

2. Set up GPG keys for bot accounts:

   • Generate GPG keys for codefresh-git-integration[bot] and cf-ci-bot-v2
   • Add private keys to GitHub secrets (BOT_GPG_PRIVATE_KEY, BOT_GPG_PASSPHRASE)
   • Add public keys to bot GitHub accounts
   • Add fingerprints to .trusted-keys

3. Enable workflows (requires admin with workflow scope):

   mv .github/workflows-examples/*.yml .github/workflows/
   git commit -S -m "Enable GPG signing workflows"
   git push

4. Configure existing CI/CD to sign commits (see BOT_SETUP.md)

5. Sign existing commits (optional but recommended):

   • Use the sign-commits workflow, or
   • Manually rebase and sign: git rebase --exec 'git commit --amend --no-edit -n -S' -i <base>

Testing

After merging and configuring GPG keys, users can trust the tap:

brew trust codefresh-io/cli

Verify signatures:

cd $(brew --repository)/Library/Taps/codefresh-io/homebrew-cli
./verify-signatures.sh

References

• Homebrew Tap Trust Documentation
• Linear Issue: DEV-387
• Affected formulae: cf2.rb, codefresh.rb

Checklist

• Documentation added (SIGNING.md, BOT_SETUP.md, CONTRIBUTING.md)
• Verification script included (verify-signatures.sh)
• Example workflows provided with README
• PR template updated with GPG requirements
• README updated with trust instructions
• GPG keys configured for bot accounts (post-merge task)
• Workflows activated (requires admin with workflow scope)
• Existing commits signed (optional, post-merge task)