release: verify commits through GitHub

[juan-fernandez]

What does this PR do?

Verifies the release commit using GitHub's commit verification API instead of the maintainer's local GPG keyring.

Motivation

The squash merge commit from #19 is signed by GitHub and reported as verified on GitHub, but git verify-commit fails when the maintainer's local GPG keyring does not contain GitHub's web-flow public key. This blocked scripts/release-orb.sh --dry-run before the planned v2 release.

This matches the release verification approach introduced in DataDog/test-visibility-github-action#70.

Additional Notes

The release helper already requires an authenticated gh session for PR label discovery, so this does not introduce another tool or authentication requirement.

Possible Drawbacks / Trade-offs

Signature validation now trusts GitHub's verification result and requires the GitHub API to be available. This avoids machine-specific GPG keyring setup and is consistent with the equivalent GitHub Action release helper.

Describe how to test/QA your changes

bash -n scripts/release-orb.sh
git diff --check origin/main...HEAD
git verify-commit HEAD
scripts/release-orb.sh --dry-run

The dry run completes successfully and proposes v2.0.0 from PR #19 without creating or pushing a tag.

[datadog-prod-us1-6]

More details

The PR correctly replaces local GPG keyring verification with GitHub's API-based verification for release commits. The implementation properly handles all response cases (verified true/false/null), correctly rejects non-verified commits, and fails safely when the GitHub API is unavailable. No behavioral regressions detected — core security semantics remain unchanged while eliminating machine-specific GPG setup.

Was this helpful? React 👍 or 👎

_{📊 Validated against 12 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit c392ea0 · What is Autotest? · Any feedback? Reach out in #autotest}