Add gitlab-ci integration to build WKD dir on tag

.gitlab-ci.yml:
Add gitlab-ci integration to build WKD dir on tag using the `make wkd`
target per FQDN used by Arch Linux. Builds only happen on a secure
runner, the job is running in its own stage after the tests and only
runs in pipelines for tags.

.gitlab-ci.yml

@@ -3,6 +3,7 @@ image: archlinux:latest
 
 stages:
   - test
+  - wkd
 
 lint:
   stage: test
@@ -71,3 +72,23 @@ keyring_check:
       - tests/*
       - .gitlab-ci.yml
       - Makefile
+
+wkd_build:
+  stage: wkd
+  needs: []
+  tags:
+    - secure
+  before_script:
+    - pacman -Syu --needed --noconfirm make python sequoia-sq
+  script:
+    - make wkd
+    - make wkd WKD_FQDN=master-key.archlinux.org
+    - make wkd_inspect
+    - make wkd_inspect WKD_FQDN=master-key.archlinux.org
+    - mkdir public
+    - cp -r build/wkd/.* public
+  artifacts:
+    paths:
+      - public
+  rules:
+    - if: $CI_PROJECT_PATH == "archlinux/archlinux-keyring" && $CI_COMMIT_TAG