[feature] Commit with gpg signing

[cdenneen]

Currently documentation shows how to utilize signing for secrets but that same gpg key can be used for commits as well.
Need to add signingkey to the spec.

[squaremo]

(I think this is a little big for a good first issue)

[lwj]

Hey, I'm looking to contribute. Could I work on this feature?

[squaremo]

Hey, I'm looking to contribute. Could I work on this feature?

That would be most welcome! I do want to put a gentle caveat here: there are a few unknowns with respect to the git libraries used (go-git and libgit2) versus signing. A bit of research up-front is worthwhile.

[lwj]

Thanks! From skimming through the code, it looks like that regardless of the git library used for pushing, go-git is always used to perform the commit itself. Perhaps a separate issue should be raised if committing under libgit2 is a requirement?

[hiddeco]

go-git has support for signing commits and can be used as an initial implementation: https://github.com/go-git/go-git/blob/1b1a61ad07f40197d3b9164821a096abd1710628/options.go#L431-L434