ci: support automatically release checksums and binaries

[Xunzhuo]

Resolve: #483

see: https://github.com/Xunzhuo/spin/releases/tag/v0.5.0

Signed-off-by: Xunzhuo mixdeers@gmail.com

[vdice]

This looks excellent, thank you for adding @Xunzhuo ! LGTM

[vdice]

@Xunzhuo one last detail. Would it be possible to add your GPG signature to the commit per https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification? Thank you.

[radu-matei]

Thank you so much, @Xunzhuo!
Once you add your commit signature, this LGTM.

Thank you so much!

[Xunzhuo]

Thanks @vdice and @radu-matei, I am on a vacation, so my computer is away from me, I will update commit signature ASAP:)

[radu-matei]

No worries, enjoy your vacation!

[radu-matei]

Hey, @Xunzhuo, bump on the commit signature here.

Thanks again for your contribution!

[Xunzhuo]

Hi @radu-matei, I checked that I have excuted git commit -s -m "xxx", what else should I do?

[vdice]

@Xunzhuo you may need to force-push the signed commit, to re-trigger the check. Can you give this a try?

[radu-matei]

You also need to sign with a GPG key — see https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification

(git commit -S -s -m "")

[vdice]

Hi @Xunzhuo , sorry for all of the trouble here. We are very close! The recent merge commit is properly signed per the 'Verified' indicator:

Alas, the original commit still needs signing with a GPG key:

One way would be to rebase this branch and squash commits down to one, GPG-signed commit. Do you think you might have a chance to do this?

We're excited to get this in and use it for the forthcoming release! Thank you.

[Xunzhuo]

Hi @Xunzhuo , sorry for all of the trouble here. We are very close! The recent merge commit is properly signed per the 'Verified' indicator:

Alas, the original commit still needs signing with a GPG key:

One way would be to rebase this branch and squash commits down to one, GPG-signed commit. Do you think you might have a chance to do this?

We're excited to get this in and use it for the forthcoming release! Thank you.

Thanks @vdice and @radu-matei , I did not use GPG before just using SSH. After configuring some steps, finally solved this:) Sorry for the delay.

[Xunzhuo]

I tested this again, see https://github.com/Xunzhuo/spin/releases/tag/v0.6.0, uploading artifacts is working well, but the automated release title is like that, should we fix this? Or let release manager to manually edit this?

[radu-matei]

cc @vdice for a final review.

Thank you for your contribution, @Xunzhuo!

[vdice]

I tested this again, see https://github.com/Xunzhuo/spin/releases/tag/v0.6.0, uploading artifacts is working well, but the automated release title is like that, should we fix this? Or let release manager to manually edit this?

First, thanks for testing again. Good question; I think for now we'll assume the release manager will manually edit the release. I/we can look at further action configuration (or alternate actions) that might provide functionality to set the release title and, ideally, utilize GitHub's auto-generated release notes functionality. Meanwhile, we're excited to bring in these excellent improvements! Thanks again @Xunzhuo 🎉