gpg -u john@example.com --detach-sign --output {your_phar_name}.phar.asc {your_phar_name}.phar
About the options:
{your_phar_name}.phar.asc
).
Last argument is the PHAR you want to sign.
https://github.com/<your-vendor>/<your-project>/releases
{your_phar_name}.phar
and {your_phar_name}.phar.asc
in the "Attach binaries..." section