From fe16d75c5802c59b3425ec3e0423d62b9ec37504 Mon Sep 17 00:00:00 2001
From: Patrick Ryan <patrickryankenneth@gmail.com>
Date: Sat, 3 Oct 2026 22:43:34 -0500
Subject: [PATCH] release-policy: verify GPG tag via GitHub verification

---
 .github/workflows/release-policy.yml | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index ddd7e99..f071fcb 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -96,21 +96,13 @@ jobs:
             exit 1
           fi
 
-      - name: Verify tag gitsign signature against pinned identity (enforced only)
+      - name: Verify tag is GitHub-verified (enforced only)
         if: env.MODE == 'enforced'
         run: |
           set -euo pipefail
-          if [ -z "${SIGNER_IDENTITY:-}" ] || [ -z "${SIGNER_ISSUER:-}" ]; then
-            echo "::error::set repository variables POLICY_SIGNER_IDENTITY and POLICY_SIGNER_ISSUER (Settings -> Secrets and variables -> Actions -> Variables)"
-            exit 1
-          fi
-          # Go is preinstalled on ubuntu-latest runners.
-          go install "github.com/sigstore/gitsign@${GITSIGN_REF}"
-          export PATH="$(go env GOPATH)/bin:$PATH"
-          gitsign verify-tag \
-            --certificate-identity "$SIGNER_IDENTITY" \
-            --certificate-oidc-issuer "$SIGNER_ISSUER" \
-            "$TAG"
+          sha="$(git rev-parse "refs/tags/${TAG}")"
+          res="$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${sha}" --jq '"\(.verification.verified) \(.verification.reason)"')"
+          [ "$res" = "true valid" ] || { echo "::error::tag ${TAG} not verified: ${res}"; exit 1; }
 
   draft:
     needs: check