Fix release workflow runner and add signing secrets (#6238)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: zglicz

.github/workflows/automated-release.yml

@@ -61,8 +61,10 @@ jobs:
       pm-email: "gabriel.vivas@sonarsource.com"
       slack-channel: "ask-squad-web"
       release-automation-secret-name: "SonarJS-release-automation"
+      runner-environment: "github-ubuntu-latest-s"
       verbose: true
       use-jira-sandbox: false
+      is-draft-release: 'false'
 
   bump_versions:
     name: Bump versions

.github/workflows/build.yml

@@ -174,6 +174,8 @@ jobs:
           secrets: |
             development/artifactory/token/{REPO_OWNER_NAME_DASH}-qa-deployer username | ARTIFACTORY_DEPLOY_USERNAME;
             development/artifactory/token/{REPO_OWNER_NAME_DASH}-qa-deployer access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;
+            development/kv/data/sign key | SIGN_KEY;
+            development/kv/data/sign passphrase | PGP_PASSPHRASE;
       - &java_coverage_cache
         name: Cache Java coverage
         uses: SonarSource/gh-action_cache@v1
@@ -186,6 +188,8 @@ jobs:
           ARTIFACTORY_DEPLOY_USERNAME: ${{ fromJSON(steps.deployer-secrets.outputs.vault).ARTIFACTORY_DEPLOY_USERNAME }}
           ARTIFACTORY_DEPLOY_PASSWORD: ${{ fromJSON(steps.deployer-secrets.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN }}
           ARTIFACTORY_DEPLOY_REPO: sonarsource-public-qa
+          SIGN_KEY: ${{ fromJSON(steps.deployer-secrets.outputs.vault).SIGN_KEY }}
+          PGP_PASSPHRASE: ${{ fromJSON(steps.deployer-secrets.outputs.vault).PGP_PASSPHRASE }}
       - name: Upload SonarJS artifacts
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with: