chore(ci): add signing env to publish workflow#15
Conversation
- Integrated `GPG_SECRET_KEY` and `GPG_PASSPHRASE` to sign staging releases. - Updated release step to use additional environment variables for Gradle tasks.
xenoterracide
changed the title
publish workflow
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
Adds Gradle GPG signing environment configuration to the publish GitHub Actions workflow so the GitHub Release step can run signing-required Gradle publish tasks during release creation.
Changes:
- Names the GitHub Release step for clarity.
- Adds
ORG_GRADLE_PROJECT_signingInMemoryKeyandORG_GRADLE_PROJECT_signingInMemoryKeyPasswordto the GitHub Release step environment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| export STAGING=$(printf "%s" $(./gradlew stagingPath --quiet)) | ||
| gh release create ${{ github.event.workflow_run.head_branch }} --generate-notes $STAGING/* --verify-tag | ||
| if: ${{ steps.detect-tag.outputs.is_tag == 'true' }} |
There was a problem hiding this comment.
gh release create is using ${{ github.event.workflow_run.head_branch }} as the release/tag name, but this job is gated on a Git tag existing at HEAD. For workflow_run executions triggered by a tag push, head_branch can be empty (and in other cases it may be a branch name), which will cause --verify-tag to fail or create a release with the wrong identifier. Prefer using the actual tag you already detect (e.g., output the tag name from detect-tag and pass that to gh release create).
| GH_TOKEN: ${{ github.token }} | ||
| ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_SECRET_KEY }} | ||
| ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_PASSPHRASE }} |
There was a problem hiding this comment.
The GPG signing env vars are now duplicated in three separate steps. To reduce drift (e.g., if secret names change), consider defining ORG_GRADLE_PROJECT_signingInMemoryKey and ORG_GRADLE_PROJECT_signingInMemoryKeyPassword once at the job env: level (or via a YAML anchor) and only override per-step if needed.
1 participant
release