build: Add key import to sign releases

.github/workflows/bump-version.yaml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - add-signing-key
 
 jobs:
   bump-version:
@@ -24,12 +25,27 @@ jobs:
             CHANGELOG.md
           sparse-checkout-cone-mode: false
 
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+          git_tag_gpgsign: true
+          fingerprint: 2B939A343491740FE1483E5C41E311388E4BB349
+
+      - name: List keys
+        run: gpg -K
+
       - name: Create bump and changelog
         uses: commitizen-tools/commitizen-action@master
         with:
           github_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
           changelog_increment_filename: body.md
 
+      - run: git verify-commit HEAD
+
       - name: Create GitHub release
         uses: ncipollo/release-action@v1
         with: