Gpg workflow

[mbolla22]

🔐 GPG Key Generation Workflow

This workflow automates the generation and distribution of GPG keys for signing New Relic Infrastructure packages.

✨ Features

🔑 Automated GPG Key Generation

Creates RSA 4096-bit keys with SHA256 hashing for package signing

📦 Dual Secret Storage

Private Keys stored in GitHub Organization Secrets:

• OHAI_GPG_PRIVATE_SHA256 - 🔄 Current (overwritten on each run)
• OHAI_GPG_PRIVATE_SHA256_<timestamp> - 📚 Historical backup

📄 Dual Public Key Storage

Repository Structure:

• gpg/keys/current/newrelic_rpm_key_current.gpg - 🔄 Current (overwritten)
• gpg/keys/new/newrelic_rpm_key_<timestamp>.gpg - 📚 Historical backup

🛡️ Security Features

• ✅ Organization-level secrets with selected repository visibility
• ✅ Secure cleanup: shred (10-pass overwrite) + rm
• ✅ Environment-based access control (GpgKeysOHAI)
• ✅ Ephemeral runner ensures no key persistence

📝 Audit Trail

Optional reason input for documentation and compliance tracking

🚀 Triggers

• 🖱️ Manual: GitHub Actions UI → "Run workflow" button

📋 Key Format

Public keys exported in ASCII-armored format for easy viewing and distribution

🎯 Use Cases

Scenario	Solution
🔐 Key Rotation	Run workflow to generate new key pair
📦 Package Signing	Use OHAI_GPG_PRIVATE_SHA256 secret
🔙 Rollback	Access timestamped backup keys
✅ Verification	Use public keys from gpg/keys/current/

[abhishuraina]

Overall LGTM, just one comment

[abhishuraina]

LGTM