fix(release): execute publication request safely

tests/test_changelog.py

@@ -70,6 +70,15 @@ def test_checked_in_changelog_keeps_unreleased_first_and_categories_limited():
     assert set(categories) <= {"Added", "Changed", "Fixed"}
 
 
+def test_release_footer_verifies_the_clearsigned_checksum_asset():
+    footer = (REPO_ROOT / "packaging" / "release-footer.md").read_text(
+        encoding="utf-8"
+    )
+
+    assert "gpg --output SHA256SUMS --decrypt SHA256SUMS.asc" in footer
+    assert "sha256sum -c SHA256SUMS" in footer
+
+
 @pytest.mark.parametrize(
     ("changelog", "expected_error"),
     [