ci: enforce signed tags

.github/workflows/publish-android.yml

@@ -26,6 +26,8 @@ jobs:
     needs: build-android
     steps:
       - uses: actions/checkout@v4
+      - name: ensure the tag is signed
+        run: git cat-file -p ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
       - name: set up jdk 17
         uses: actions/setup-java@v4
         with:

.github/workflows/publish-jvm.yml

@@ -26,6 +26,8 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
+      - name: ensure the tag is signed
+        run: git cat-file -p ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
       - name: setup rust
         uses: actions-rust-lang/setup-rust-toolchain@v1  # this implicitly caches Rust tools and build artifacts
         with:

.github/workflows/publish-swift.yml

@@ -25,6 +25,8 @@ jobs:
         with:
           xcode-version: '14.3.1'
       - uses: actions/checkout@v4
+      - name: ensure the tag is signed
+        run: git cat-file -p ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
       - name: "setup rust"
         uses: actions-rust-lang/setup-rust-toolchain@v1  # this implicitly caches Rust tools and build artifacts
         with:

.github/workflows/publish-wasm.yml

@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: ensure the tag is signed
+        run: git cat-file -p ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           target: wasm32-unknown-unknown