ci: check commits are GPG signed

[delta1]

Adds a new workflow to check that commits are GPG signed as required for merging

[KyrylR]

Why we can not use “Require signed commits” branch protection? (can be enabled via repo setting)

[KyrylR]

It looks like it is already enabled

[stringhandler]

CI is better as it will tell contributors automatically. The branch protection rule will only tell the user who wants to merge. (Both is the best)

[KyrylR]

CI is better as it will tell contributors automatically. The branch protection rule will only tell the user who wants to merge. (Both is the best)

Got it, then maybe we can reuse this: https://github.com/1Password/check-signed-commits-action?

[KyrylR]

So instead of the custom script, we do it like follows:

name: Check signed commits in PR 
on: pull_request_target

jobs:
  check-signed-commits:
    name: Check signed commits in PR
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Check signed commits in PR
        uses: 1Password/check-signed-commits-action@v1

[apoelstra]

I mildly prefer the custom script. We don't need to worry about supply chain issues and updates and old versions being deleted, and it will be less hassle if/when we move off of Github.

[apoelstra]

ACK 5fc139b; successfully ran local tests