Merge pull request #2603 from nschonni/release-keys-ci

chore: add automation for release keys

Author: nschonni

.github/workflows/automatic-release-keys.yml

@@ -0,0 +1,34 @@
+name: Automatically update Node.js team release keys
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 12 * * 1'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'nodejs'
+    permissions:
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run automation script
+        run: ./update-keys.sh
+
+      - name: Create update PR
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GH_API_TOKEN }}
+          author: 'Node.js GitHub Bot <nodejs-github-bot@users.noreply.github.com>'
+          branch: keys-branch
+          base: main
+          commit-message: 'chore: Node.js release key sync'
+          title: 'chore: Node.js release key sync'
+          body: Open based on changes from `update-keys.sh`. For details on whose key is changing, look at https://github.com/nodejs/node#release-keys
+          delete-branch: true
+          team-reviewers: |
+            nodejs/docker
+            nodejs/releasers

.github/workflows/node-keys.yml

@@ -0,0 +1,24 @@
+name: Node.js Release Key Check
+
+on:
+  pull_request:
+    paths:
+      - keys/node.keys
+      - .github/workflows/node-keys.yml
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'nodejs'
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run automation script
+        run: ./update-keys.sh
+
+      - name: Ensure no git changes
+        run: git diff --exit-code