REL-554 Set GPG key trust level

devops/setup-gpg/action.yaml

@@ -11,6 +11,10 @@ inputs:
   gpg-public-key:
     description: 'GPG public key exported as an ASCII armored version or its base64 encoding'
     required: true
+  gpg-trust-level:
+    description: 'Set key trust level'
+    required: false
+    default: 5
 runs:
   using: "composite"
   steps:
@@ -48,20 +52,57 @@ runs:
         shell: bash
       - name: install tools
         run: |
-          sudo apt-get update && sudo apt-get install ca-certificates gnupg dpkg-dev dpkg-sig rpm -y
+          sudo apt-get update && sudo apt-get install ca-certificates gnupg dpkg-dev dpkg-sig rpm expect -y
         shell: bash
       - name: Set up GPG
         env:
           GPG_PRIVATE_KEY: ${{ inputs.gpg-private-key }}
           GPG_KEY_PASS: ${{ inputs.gpg-key-pass }}
           GPG_ID: ${{ inputs.gpg-key-name }}
           GPG_PUBLIC_KEY: ${{ inputs.gpg-public-key }}
+          GPG_TRUST_LEVEL: ${{ inputs.gpg-trust-level }}
+          SET_TRUST_LEVEL: |
+            #!/bin/bash
+
+            # Set the key ID and the desired trust level
+            KEY_ID=$1        # Pass the key ID or fingerprint as an argument
+            TRUST_LEVEL=$2   # Pass the trust level as an argument (1-5)
+
+            # Check if both arguments are provided
+            if [ -z "$KEY_ID" ] || [ -z "$TRUST_LEVEL" ]; then
+               echo "Usage: $0 <key-id> <trust-level>"
+               echo "Trust levels: 1 = I don't trust, 2 = I do NOT trust, 3 = I trust marginally, 4 = I trust fully, 5 = I trust ultimately"
+               exit 1
+            fi
+
+            # Check if the provided trust level is valid
+            if [[ "$TRUST_LEVEL" -lt 1 || "$TRUST_LEVEL" -gt 5 ]]; then
+               echo "Invalid trust level. Trust levels: 1-5"
+               exit 1
+            fi
+
+            # Use 'expect' to automate gpg trust level interaction
+            expect << EOF
+              spawn gpg --edit-key $KEY_ID
+              expect "gpg>"
+              send "trust\r"
+              expect "Your decision?"
+              send "$TRUST_LEVEL\r"
+              expect "Do you really want to set this key to ultimate trust? (y/N)"
+              send "y\r"
+              expect "gpg>"
+              send "save\r"
+              expect eof
+            EOF
         run: |
           # Setup gpg
           mkdir -p ~/.gnupg
           chmod 700 ~/.gnupg
           echo "$GPG_PRIVATE_KEY" | gpg --import --batch --yes
           echo "$GPG_KEY_PASS"
+          echo -e "$SET_TRUST_LEVEL" > ~/set-gpg-trust.sh
+          chmod a+x ~/set-gpg-trust.sh
+          ~/set-gpg-trust.sh "$GPG_ID" "$GPG_TRUST_LEVEL"
 
           # configure for non-interactive use
           export GPG_TTY=no-tty