simplify GPG credential passing via environment variables in publish workflows

Author: jcpitre

.github/workflows/build.yml

@@ -3,6 +3,7 @@ on:
   pull_request:
     branches:
       - master
+  workflow_dispatch:
 jobs:
   maven-package:
     runs-on: ubuntu-24.04

.github/workflows/release.yml

@@ -66,21 +66,6 @@ jobs:
             echo "MAVEN_CENTRAL_PORTAL_TOKEN_USERNAME=$MVN_USER"
             echo "MAVEN_CENTRAL_PORTAL_TOKEN_PASSWORD=$MVN_PASS"
           } >> "$GITHUB_ENV"
-      - name: Setup GPG and JReleaser credentials
-        run: |
-          echo "$MAVEN_GPG_PRIVATE_KEY" | gpg --batch --import
-          GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format LONG | grep '^sec' | awk '{print $2}' | cut -d'/' -f2 | head -1)
-          {
-            echo "JRELEASER_GPG_PUBLIC_KEY<<GPG_EOF"
-            gpg --armor --export "$GPG_KEY_ID"
-            echo "GPG_EOF"
-            echo "JRELEASER_GPG_SECRET_KEY<<GPG_EOF"
-            gpg --armor --export-secret-keys "$GPG_KEY_ID"
-            echo "GPG_EOF"
-            echo "JRELEASER_GPG_PASSPHRASE=$MAVEN_GPG_PASSPHRASE"
-            echo "JRELEASER_MAVENCENTRAL_SONATYPE_USERNAME=$MAVEN_CENTRAL_PORTAL_TOKEN_USERNAME"
-            echo "JRELEASER_MAVENCENTRAL_SONATYPE_PASSWORD=$MAVEN_CENTRAL_PORTAL_TOKEN_PASSWORD"
-          } >> "$GITHUB_ENV"
       - name: Stage artifacts
         run: mvn deploy -Ppublication -Dprettier.skip=true
       - name: Deploy to Maven Central
@@ -89,6 +74,8 @@ jobs:
         # jreleaser:deploy only handles Maven Central; GitHub release management is done by the GitHub UI.
         env:
           JRELEASER_DEPLOY_MAVEN_MAVENCENTRAL_SONATYPE_PUBLISHING_TYPE: ${{ github.event.action == 'prereleased' && 'USER_MANAGED' || 'AUTOMATIC' }}
+          JRELEASER_GPG_PASSPHRASE: ${{ env.MAVEN_GPG_PASSPHRASE }}
+          JRELEASER_GPG_SECRET_KEY: ${{ env.MAVEN_GPG_PRIVATE_KEY }}
         run: mvn jreleaser:deploy -Djreleaser.output.directory=out
       - name: Upload CLI fat jar to GitHub release
         run: |

pom.xml

@@ -52,7 +52,7 @@
         <tag>HEAD</tag>
     </scm>
     <properties>
-        <jreleaser-maven-plugin.version>1.20.0</jreleaser-maven-plugin.version>
+        <jreleaser-maven-plugin.version>1.23.0</jreleaser-maven-plugin.version>
         <sonar-maven-plugin.version>5.2.0.4988</sonar-maven-plugin.version>
         <prettier-java.version>2.1.0</prettier-java.version>
         <prettier-maven-plugin.version>0.22</prettier-maven-plugin.version>
@@ -69,6 +69,11 @@
                         <signing>
                             <active>ALWAYS</active>
                             <armored>true</armored>
+                            <!-- verify=false: skips local signature verification after signing.
+                                 Maven Central performs its own verification on upload, so this
+                                 is redundant locally and requires BouncyCastle to re-parse the
+                                 public key, which fails in some JReleaser versions. -->
+                            <verify>false</verify>
                         </signing>
                         <deploy>
                             <maven>
@@ -77,6 +82,8 @@
                                         <active>RELEASE</active>
                                         <url>https://central.sonatype.com/api/v1/publisher</url>
                                         <stagingRepositories>target/staging-deploy</stagingRepositories>
+                                        <username>${env.MAVEN_CENTRAL_PORTAL_TOKEN_USERNAME}</username>
+                                        <password>${env.MAVEN_CENTRAL_PORTAL_TOKEN_PASSWORD}</password>
                                     </sonatype>
                                 </mavenCentral>
                                 <nexus2>
@@ -89,6 +96,8 @@
                                         <closeRepository>true</closeRepository>
                                         <releaseRepository>true</releaseRepository>
                                         <stagingRepositories>target/staging-deploy</stagingRepositories>
+                                        <username>${env.MAVEN_CENTRAL_PORTAL_TOKEN_USERNAME}</username>
+                                        <password>${env.MAVEN_CENTRAL_PORTAL_TOKEN_PASSWORD}</password>
                                     </maven-central>
                                 </nexus2>
                             </maven>