Apply suggestions from code review

Co-authored-by: Babak K. Shandiz <babakks@github.com>

Author: niik

.github/workflows/deployment.yml

@@ -20,13 +20,13 @@ on:
       environment:
         default: production
         type: environment
-        description: "The deployment environment..."
+        description: "The deployment environment."
       platforms:
         default: "linux,macos,windows"
         type: string
         description: "Comma-separated list of platforms to build."
       release:
-        description: "Whether to create a GitHub Release"
+        description: "Whether to run the final release job. the dry_run flag still blocks final submissions."
         type: boolean
         default: true
       dry_run:
@@ -113,16 +113,16 @@ jobs:
         run: |
           # create a keychain for the certificate
           PW=pwd.${{ github.run_number }}
-          security create-keychain -p $PW $RUNNER_TEMP/build.keychain
+          security create-keychain -p $PW "$RUNNER_TEMP/build.keychain"
           security set-keychain-settings -lut 21600 "$RUNNER_TEMP/build.keychain"
-          security default-keychain -s $RUNNER_TEMP/build.keychain
-          security unlock-keychain -p $PW $RUNNER_TEMP/build.keychain
+          security default-keychain -s "$RUNNER_TEMP/build.keychain"
+          security unlock-keychain -p $PW "$RUNNER_TEMP/build.keychain"
 
           # import the certificate
-          base64 -d <<<"$DEVELOPER_ID_CERT" > $RUNNER_TEMP/cert.p12
-          security import $RUNNER_TEMP/cert.p12 -k $RUNNER_TEMP/build.keychain -P "$DEVELOPER_ID_CERT_PASSWORD" -T /usr/bin/codesign
-          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $PW $RUNNER_TEMP/build.keychain
-          rm $RUNNER_TEMP/cert.p12
+          base64 -d <<< "$DEVELOPER_ID_CERT" > "$RUNNER_TEMP/cert.p12"
+          security import "$RUNNER_TEMP/cert.p12" -k "$RUNNER_TEMP/build.keychain" -P "$DEVELOPER_ID_CERT_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $PW "$RUNNER_TEMP/build.keychain"
+          rm "$RUNNER_TEMP/cert.p12"
 
       - name: Add App Store Connect API key to keychain
         if: inputs.environment == 'production'
@@ -142,7 +142,7 @@ jobs:
             --key "${{ steps.setup-apple-codesign.outputs.app-store-connect-api-key-key-path }}" \
             --key-id "${{ steps.setup-apple-codesign.outputs.app-store-connect-api-key-key-id }}" \
             --issuer "${{ steps.setup-apple-codesign.outputs.app-store-connect-api-key-issuer-id }}" \
-            --keychain $RUNNER_TEMP/build.keychain
+            --keychain "$RUNNER_TEMP/build.keychain"
 
       - name: Install GoReleaser
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
@@ -394,27 +394,22 @@ jobs:
           create-storage-record: false # (default: true)
       - name: Run createrepo
         if: ${{ inputs.environment == 'production' }}
-        env:
-          GPG_SIGN: ${{ inputs.environment == 'production' }}
         run: |
           mkdir -p site/packages/rpm
           cp dist/*.rpm site/packages/rpm/
           ./script/createrepo.sh
           cp -r dist/repodata site/packages/rpm/
           pushd site/packages/rpm
-          [ "$GPG_SIGN" = "false" ] || gpg --yes --detach-sign --armor repodata/repomd.xml
+          gpg --yes --detach-sign --armor repodata/repomd.xml
           popd
       - name: Run reprepro
         if: ${{ inputs.environment == 'production' }}
-        env:
-          GPG_SIGN: ${{ inputs.environment == 'production' }}
           # We are no longer adding to the distribution list.
           # All apt distributions should use "stable" according to our install documentation.
           # In the future we will remove legacy distributions listed here.
           RELEASES: "cosmic eoan disco groovy focal stable oldstable testing sid unstable buster bullseye stretch jessie bionic trusty precise xenial hirsute impish kali-rolling"
         run: |
           mkdir -p upload
-          [ "$GPG_SIGN" = "true" ] || sed -i.bak '/^SignWith:/d' script/distributions
           for release in $RELEASES; do
             for file in dist/*.deb; do
               reprepro --confdir="+b/script" includedeb "$release" "$file"