Verify base & sign commits/tags

Author: dflook

.github/workflows/release.yaml

@@ -54,6 +54,7 @@ jobs:
         id: image_build
         env:
           RELEASE_TAG: "test.0.0"
+          GH_TOKEN: ${{ github.token }}
         run: |
           BASE_TAG=$(docker buildx imagetools inspect danielflook/terraform-github-actions-base:latest --format '{{json .}}' | jq -r '.manifest.annotations."ref.tag"')
           BASE_DIGEST=$(docker buildx imagetools inspect danielflook/terraform-github-actions-base:$BASE_TAG --format '{{json .}}' | jq -r '.manifest.digest')