Skip to content

Commit bd906d8

Browse files
itskavinitskavin
committed
Enhance GPG key import and tag verification process in release workflow
1 parent b96e178 commit bd906d8

1 file changed

Lines changed: 93 additions & 4 deletions

File tree

‎.github/workflows/create-release.yml‎

Lines changed: 93 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,31 +29,58 @@ jobs:
2929
GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
3030
run: |
3131
echo "Verifying tag signature for v${{ inputs.version }}..."
32+
<<<<<<< Updated upstream
3233

3334
# Import GPG public key
35+
=======
36+
TAG_VERIFIED=false
37+
38+
# Import GPG key if available
39+
>>>>>>> Stashed changes
3440
if [ -n "$GPG_PUBLIC_KEY" ]; then
3541
# Write the key to a file first to avoid shell interpretation issues
3642
echo "$GPG_PUBLIC_KEY" > /tmp/gpg_public_key.asc
3743
# Fix any potential line ending issues
3844
sed -i 's/\r$//' /tmp/gpg_public_key.asc
45+
<<<<<<< Updated upstream
3946
# Make sure the key file has proper GPG armor headers
47+
=======
48+
49+
# Ensure key has proper PGP headers
50+
>>>>>>> Stashed changes
4051
if ! grep -q "^-----BEGIN PGP PUBLIC KEY BLOCK-----" /tmp/gpg_public_key.asc; then
52+
echo "Adding PGP headers to key..."
4153
echo "-----BEGIN PGP PUBLIC KEY BLOCK-----" > /tmp/fixed_key.asc
4254
cat /tmp/gpg_public_key.asc >> /tmp/fixed_key.asc
4355
echo "-----END PGP PUBLIC KEY BLOCK-----" >> /tmp/fixed_key.asc
4456
mv /tmp/fixed_key.asc /tmp/gpg_public_key.asc
4557
fi
58+
<<<<<<< Updated upstream
4659
# Import the key from the file
4760
gpg --batch --import /tmp/gpg_public_key.asc || echo "::warning::Failed to import GPG key, but continuing..."
4861
echo "GPG Public Key import attempted."
4962
echo "Available GPG keys:"
5063
gpg --list-keys # List keys for debugging
5164
# Clean up
5265
rm -f /tmp/gpg_public_key.asc
66+
=======
67+
68+
# Import key with better error handling
69+
gpg --batch --import /tmp/gpg_public_key.asc 2>/tmp/gpg_import_error || true
70+
if [ -s /tmp/gpg_import_error ]; then
71+
echo "::warning::GPG key import had issues:"
72+
cat /tmp/gpg_import_error
73+
fi
74+
75+
echo "GPG Public Key imported. Available GPG keys:"
76+
gpg --list-keys
77+
rm -f /tmp/gpg_public_key.asc /tmp/gpg_import_error
78+
>>>>>>> Stashed changes
5379
else
54-
echo "::warning:: GPG_PUBLIC_KEY secret not found. Cannot import key for tag verification."
80+
echo "::warning::GPG_PUBLIC_KEY secret not found. Will skip signature verification."
5581
fi
5682

83+
<<<<<<< Updated upstream
5784
# Check if tag exists in local repository
5885
if ! git tag -l "v${{ inputs.version }}" | grep -q "v${{ inputs.version }}"; then
5986
echo "Tag not found in local repository, attempting to fetch from remote..."
@@ -62,23 +89,50 @@ jobs:
6289
fi
6390

6491
# Verify that the tag exists now
92+
=======
93+
# Make sure tag exists
94+
if ! git tag -l "v${{ inputs.version }}" | grep -q "v${{ inputs.version }}"; then
95+
echo "Tag not found in local repository, attempting to fetch from remote..."
96+
git fetch origin tag "v${{ inputs.version }}" --no-tags || echo "Could not fetch tag from remote"
97+
fi
98+
99+
# Check if tag exists
100+
>>>>>>> Stashed changes
65101
if ! git tag -l "v${{ inputs.version }}" | grep -q "v${{ inputs.version }}"; then
66102
echo "::error::Tag v${{ inputs.version }} not found in both local and remote repositories!"
67103
exit 1
68104
fi
69105

106+
<<<<<<< Updated upstream
70107
# Attempt to verify the tag signature
71108
if git verify-tag "v${{ inputs.version }}" 2>&1 | grep -q "Good signature"; then
109+
=======
110+
# Try signature verification (but don't fail if not signed)
111+
echo "Attempting to verify tag signature..."
112+
VERIFY_OUTPUT=$(git verify-tag "v${{ inputs.version }}" 2>&1) || true
113+
echo "Verification output: $VERIFY_OUTPUT"
114+
115+
if echo "$VERIFY_OUTPUT" | grep -q "Good signature"; then
116+
>>>>>>> Stashed changes
72117
echo "✅ Tag v${{ inputs.version }} has a valid GPG signature!"
118+
TAG_VERIFIED=true
73119
else
74-
echo "::warning::Tag v${{ inputs.version }} is not GPG-signed or has an invalid signature."
75-
echo "For verified releases, please use a GPG-signed tag:"
120+
echo "::warning::Tag v${{ inputs.version }} could not be verified with GPG signature."
121+
echo "Continuing workflow but release will be marked as unverified."
122+
echo "For fully verified releases, please use a GPG-signed tag:"
76123
echo " git tag -s v${{ inputs.version }} -m \"Release version ${{ inputs.version }}\""
77124
echo " git push origin v${{ inputs.version }}"
125+
<<<<<<< Updated upstream
78126

79127
# Enforce signed tags for verified releases
80128
exit 1
129+
=======
130+
>>>>>>> Stashed changes
81131
fi
132+
133+
# Set verification status for later steps
134+
echo "tag_verified=$TAG_VERIFIED" >> $GITHUB_OUTPUT
135+
id: verify_tag
82136

83137
- name: Download all artifacts
84138
uses: actions/download-artifact@v4
@@ -176,16 +230,33 @@ jobs:
176230
- name: Create Release with Provenance
177231
env:
178232
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
233+
TAG_VERIFIED: ${{ steps.verify_tag.outputs.tag_verified }}
179234
run: |
180235
VERSION="${{ inputs.version }}"
181236
INSTALLER_PATH="${{ steps.find_installer.outputs.path }}" # Use path from previous step
182237
183238
echo "Windows installer to upload: $INSTALLER_PATH"
184239
240+
<<<<<<< Updated upstream
185241
# Check if release already exists
242+
=======
243+
VERIFICATION_STATUS=""
244+
if [ "$TAG_VERIFIED" = "true" ]; then
245+
VERIFICATION_STATUS="✅ This release is signed with a verified GPG key."
246+
else
247+
VERIFICATION_STATUS="⚠️ This release was not verified with a GPG signature."
248+
fi
249+
250+
>>>>>>> Stashed changes
186251
if gh release view "v$VERSION" &>/dev/null; then
187-
echo "Release v$VERSION already exists. Skipping creation but will upload artifacts."
252+
echo "Release v$VERSION already exists. Updating verification status and uploading artifacts."
253+
EXISTING_BODY=$(gh release view "v$VERSION" --json body --jq .body)
254+
if ! echo "$EXISTING_BODY" | grep -q "This release"; then
255+
NEW_BODY="$VERIFICATION_STATUS\n\n$EXISTING_BODY"
256+
gh release edit "v$VERSION" --notes "$NEW_BODY"
257+
fi
188258
else
259+
<<<<<<< Updated upstream
189260
# Create release with provenance, attaching the main artifact directly
190261
gh release create "v$VERSION" \
191262
"$INSTALLER_PATH" \
@@ -200,6 +271,24 @@ jobs:
200271
View the build: https://github.com/kavinthangavel/Media-Player-Scrobbler-for-Simkl/actions/runs/${{ github.run_id }}" \
201272
--generate-notes \
202273
--verify-tag \
274+
=======
275+
NOTES=$(cat <<EOF
276+
$VERIFICATION_STATUS
277+
278+
This is release version $VERSION of Media Player Scrobbler for Simkl.
279+
280+
## Installation
281+
Download the Windows installer and run it to install the application.
282+
283+
## Verification
284+
See the README.md in the release assets for information on how to verify this release.
285+
EOF
286+
)
287+
gh release create "v$VERSION" \
288+
"$INSTALLER_PATH" \
289+
--title "Release $VERSION" \
290+
--notes "$NOTES" \
291+
>>>>>>> Stashed changes
203292
--discussion-category "Releases"
204293
echo "Release created and Windows installer attached."
205294
fi

0 commit comments

Comments
 (0)