How are you signing your software? Gave GPG key to a github action?