Automate checkings on push and tags

Update github actions workflows to check tags signed.
Validate if code is not vulnarble.

.github/workflows/analysis.yml

@@ -0,0 +1,52 @@
+---
+
+name: Analysis
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  schedule:
+    - cron: 13 7 * * 6
+
+jobs:
+  linting:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: shellcheck
+        uses: azohra/shell-linter@6bbeaa868df09c34ddc008e6030cfe89c03394a1
+        with:
+          path: scripts/test-*
+          severity: error
+
+      - name: yaml-lint
+        uses: ibiqlik/action-yamllint@v3
+        with:
+          config_file: .yamllint.yml
+
+  vulnerabilities:
+    runs-on: ubuntu-latest
+
+    permissions:
+      security-events: write
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: initialize
+        uses: github/codeql-action/init@v1
+        with:
+          languages: ruby
+
+      - name: codeql analyze
+        uses: github/codeql-action/analyze@v1

.github/workflows/pre_release.yml

@@ -0,0 +1,45 @@
+---
+
+name: Pre release
+
+on:
+  push:
+    tags: [ v*.*.* ]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      -
+        name: GPG config
+        run: |
+          mkdir -p ~/.gnupg
+          cat << EOF >> ~/.gnupg/options
+          keyserver keys.openpgp.org
+          keyserver-options auto-key-retrieve
+          EOF
+
+      -
+        name: Verify tag signature
+        run: |
+          # NOTE: Solve the problem with Github action checkout
+          # https://github.com/actions/checkout/issues/290
+          git fetch --tags --force
+
+          version=${GITHUB_REF#refs/tags/*}
+          git show $version
+          git tag -v $version

.github/workflows/ci.yml → .github/workflows/test.yml

@@ -1,5 +1,13 @@
-name: Run tests
-on: [push]
+---
+
+name: Test
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
 jobs:
   test:
     runs-on: ubuntu-latest