extract key sha

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

.github/workflows/release.yml

@@ -32,6 +32,16 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
+      # Force fetch upstream tags -- because 65 minutes
+      # tl;dr: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4.2.2 runs this line:
+      #   git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +ebc278ec98bb24f2852b61fde2a9bf2e3d83818b:refs/tags/
+      # which makes its own local lightweight tag, losing all the annotations in the process. Our earlier script ran:
+      #   git fetch --prune --unshallow
+      # which doesn't overwrite that tag because that would be destructive.
+      # Credit to @francislavoie for the investigation.
+      # https://github.com/actions/checkout/issues/290#issuecomment-680260080
+      - name: Force fetch upstream tags
+        run: git fetch --tags --force
 
       - name: Get tag info
         id: info
@@ -97,14 +107,44 @@ jobs:
           echo "Verifying the tag: ${{ steps.vars.outputs.version_tag }}"
           
           # Verify the tag is signed
-          if ! git verify-tag -v "${{ steps.vars.outputs.version_tag }}" 2>&1 | tee /tmp/verify-output.txt; then
+          if ! git verify-tag -v "${{ steps.vars.outputs.version_tag }}" 2>&1; then
             echo "❌ Tag verification failed!"
             echo "passed=false" >> $GITHUB_OUTPUT
             git push --delete origin "${{ steps.vars.outputs.version_tag }}"
             exit 1
           fi
+          
+          # Run it again to capture the output
+          git verify-tag -v "${{ steps.vars.outputs.version_tag }}" 2>&1 | tee /tmp/verify-output.txt;
+
+          # Extract SSH key information from verification output
+          
+          # SSH verification output typically includes the key fingerprint
+          # Use GNU grep with Perl regex for cleaner extraction (Linux environment)
+          KEY_SHA256=$(grep -oP "SHA256:[\"']?\K[A-Za-z0-9+/=]+(?=[\"']?)" /tmp/verify-output.txt | head -1 || echo "")
+          
+          if [ -z "$KEY_SHA256" ]; then
+            # Try alternative pattern with "key" prefix
+            KEY_SHA256=$(grep -oP "key SHA256:[\"']?\K[A-Za-z0-9+/=]+(?=[\"']?)" /tmp/verify-output.txt | head -1 || echo "")
+          fi
+          
+          if [ -z "$KEY_SHA256" ]; then
+            # Fallback: extract any base64-like string (40+ chars)
+            KEY_SHA256=$(grep -oP '[A-Za-z0-9+/]{40,}=?' /tmp/verify-output.txt | head -1 || echo "")
+          fi
+          
+          if [ -z "$KEY_SHA256" ]; then
+            echo "Somehow could not extract SSH key fingerprint from git verify-tag output"
+            echo "Cancelling flow and deleting tag"
+            echo "passed=false" >> $GITHUB_OUTPUT
+            git push --delete origin "${{ steps.vars.outputs.version_tag }}"
+            exit 1
+          fi
+          
           echo "✅ Tag verification succeeded!"
+          echo "SSH Key SHA256: $KEY_SHA256"
           echo "passed=true" >> $GITHUB_OUTPUT
+          echo "key_id=$KEY_SHA256" >> $GITHUB_OUTPUT
 
       - name: Find related release proposal
         id: find_proposal
@@ -241,7 +281,7 @@ jobs:
                 '## ✅ Release Tag Created and Verified',
                 '',
                 '- **Tag:** ${{ steps.info.outputs.version }}',
-                '- **Signed by key:** ${{ steps.verify.outputs.key_id }}',
+                '- **SSH Key SHA256:** ${{ steps.verify.outputs.key_id }}',
                 `- **Approvals:** ${result.approvals} maintainers (${result.approvers})`,
                 '- **Commit:** ${{ steps.info.outputs.sha }}',
                 '',
@@ -289,7 +329,7 @@ jobs:
           echo "- **Commit:** ${{ steps.info.outputs.sha }}" >> $GITHUB_STEP_SUMMARY
           echo "- **Proposed Commit:** $PROPOSED_COMMIT" >> $GITHUB_STEP_SUMMARY
           echo "- **Signature:** ✅ Verified" >> $GITHUB_STEP_SUMMARY
-          echo "- **Signed by:** ${{ steps.verify.outputs.key_id }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **SSH Key SHA256:** ${{ steps.verify.outputs.key_id }}" >> $GITHUB_STEP_SUMMARY
           echo "- **Approvals:** ✅ Sufficient" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "Proceeding with release build..." >> $GITHUB_STEP_SUMMARY