CI/tags: always use .release-signers from HEAD

Author: philpennock

.github/workflows/tags.yaml

@@ -39,7 +39,16 @@ jobs:
         name: Import keys
         shell: bash
         run: |2
-          for ghUser in $GitHubSigningUsers; do
+          allowed_signers_file=.release-signers
+          declare -a GitHubSigningUsers=()
+          while read -r line; do
+            case "${line:-#}" in
+              \#*) ;;
+              *) GitHubSigningUsers+=("$line") ;;
+            esac
+          done <<< "$(git cat-file -p "origin/HEAD:$allowed_signers_file")"
+          typeset -p GitHubSigningUsers
+          for ghUser in "${GitHubSigningUsers[@]}"; do
             echo "::debug::importing from GitHub any OpenPGP keys for user ${ghUser@Q}"
             curl -fSsL "https://github.com/$ghUser.gpg" | gpg --import || true
           done

.release-signers

@@ -0,0 +1,2 @@
+# These are the GitHub users who can sign a release tag
+philpennock