gpg -u john@example.com --detach-sign --output {your_phar_name}.phar.asc {your_phar_name}.phar
About the options:
{your_phar_name}.phar.asc).
Last argument is the PHAR you want to sign.
https://github.com/<your-vendor>/<your-project>/releases{your_phar_name}.phar and {your_phar_name}.phar.asc in the "Attach binaries..." section