AAE-46943 Sign Crowdin translation PR commits with GPG (#11974)

* AAE-46943 Sign Crowdin translation PR commits with GPG

Add GPG signing and the service-account commit identity to the Crowdin
pull workflow so automated-translations-update commits satisfy the
"Require signed commits" branch protection rule.

* AAE-46943 Pass signing key secret through reusable Crowdin workflow

Declare SERVICE_ACCOUNT_SIGNING_KEY in workflow_call.secrets and pass it
from release.yml so commit signing also works when pull-from-crowdin is
invoked as a reusable workflow.

.github/workflows/pull-from-crowdin.yml

@@ -9,6 +9,8 @@ on:
         required: true
       CROWDIN_TRANSLATIONS_TOKEN:
         required: true
+      HXP_GIT_COMMIT_SIGNING_PRIVATE_KEY:
+        required: true
 jobs:
   pull-from-crowdin:
     runs-on: ubuntu-latest
@@ -28,6 +30,9 @@ jobs:
           localization_branch_name: automated-translations-update
           pull_request_title: "GH auto: Automated Update of Translations from Crowdin"
           pull_request_base_branch_name: develop
+          github_user_name: ${{ vars.HXP_GIT_USERNAME }}
+          github_user_email: ${{ vars.HXP_GIT_EMAIL }}
+          gpg_private_key: ${{ secrets.HXP_GIT_COMMIT_SIGNING_PRIVATE_KEY }}
         env:
           GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
           CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}

.github/workflows/release.yml

@@ -173,6 +173,7 @@ jobs:
     secrets:
       BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
       CROWDIN_TRANSLATIONS_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
+      HXP_GIT_COMMIT_SIGNING_PRIVATE_KEY: ${{ secrets.HXP_GIT_COMMIT_SIGNING_PRIVATE_KEY }}
 
   finalize:
     if: always()