Skip to content

Commit 5cff215

Browse files
dkarterdkarter
authored
fix: sign release please commits (#22)
* fix: exclude changelog from formatting * chore: sign release please commits * fix: set release please committer * fix: use release please signer author
1 parent 828f8c5 commit 5cff215

3 files changed

Lines changed: 153 additions & 1 deletion

File tree

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,15 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: Release Please
17-
uses: googleapis/release-please-action@v5.0.0
17+
uses: dkarter/release-please-action@5931f1e9ef68429590dc13ea0655d0a2708cbd2f
1818
with:
1919
token: ${{ secrets.RELEASE_PLEASE_GITHUB_TOKEN || github.token }}
2020
config-file: release-please-config.json
2121
manifest-file: .release-please-manifest.json
22+
signing-gpg-private-key: ${{ secrets.RELEASE_PLEASE_GPG_PRIVATE_KEY }}
23+
signing-gpg-passphrase: ${{ secrets.RELEASE_PLEASE_GPG_PASSPHRASE }}
24+
signing-gpg-key-id: ${{ secrets.RELEASE_PLEASE_GPG_KEY_ID }}
25+
signing-commit-author-name: release-please-signer
26+
signing-commit-author-email: 293262735+release-please-signer@users.noreply.github.com
27+
signing-commit-committer-name: release-please-signer
28+
signing-commit-committer-email: 293262735+release-please-signer@users.noreply.github.com

‎mise.toml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,11 @@ status=0
3333
done
3434
exit $status
3535
"""
36+
37+
[tasks."release:signing-key"]
38+
description = "Generate/export the release-please GPG signing key"
39+
file = "scripts/release-please-gpg-key.sh"
40+
41+
[tasks."release:signing-key:print"]
42+
description = "Print release-please GPG signing values to stdout"
43+
run = "bash scripts/release-please-gpg-key.sh --print"

‎scripts/release-please-gpg-key.sh‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
#!/usr/bin/env bash
2+
#MISE description "Generate/export the release-please GPG signing key"
3+
#USAGE flag "--print" help="Print key material and secret values to stdout"
4+
set -euo pipefail
5+
6+
name="release-please-signer"
7+
email="293262735+release-please-signer@users.noreply.github.com"
8+
uid="${name} <${email}>"
9+
output_dir="${RELEASE_PLEASE_GPG_OUTPUT_DIR:-}"
10+
print_values="false"
11+
12+
if [[ "${usage_print:-false}" == "true" ]]; then
13+
print_values="true"
14+
fi
15+
16+
usage() {
17+
printf 'Usage: %s [--print]\n' "${0##*/}"
18+
printf '\n'
19+
printf 'Generates a release-please GPG signing key if one does not exist, then exports:\n'
20+
printf ' RELEASE_PLEASE_GPG_PRIVATE_KEY\n'
21+
printf ' RELEASE_PLEASE_GPG_KEY_ID\n'
22+
printf ' RELEASE_PLEASE_GPG_PASSPHRASE, if RELEASE_PLEASE_GPG_PASSPHRASE is set\n'
23+
printf '\n'
24+
printf 'Environment:\n'
25+
printf ' RELEASE_PLEASE_GPG_PASSPHRASE Optional passphrase for a new key\n'
26+
printf ' RELEASE_PLEASE_GPG_OUTPUT_DIR Optional output directory; defaults to a new temp directory\n'
27+
printf '\n'
28+
printf 'Use --print only if you intentionally want key material printed to stdout.\n'
29+
}
30+
31+
while (($#)); do
32+
case "$1" in
33+
--print)
34+
print_values="true"
35+
;;
36+
-h|--help)
37+
usage
38+
exit 0
39+
;;
40+
*)
41+
printf 'Unknown argument: %s\n' "$1" >&2
42+
usage >&2
43+
exit 2
44+
;;
45+
esac
46+
shift
47+
done
48+
49+
if ! command -v gpg >/dev/null 2>&1; then
50+
printf 'gpg is required but was not found in PATH.\n' >&2
51+
exit 1
52+
fi
53+
54+
if [[ -z "$output_dir" ]]; then
55+
output_dir="$(mktemp -d "${TMPDIR:-/tmp}/release-please-signer.XXXXXX")"
56+
else
57+
mkdir -p "$output_dir"
58+
fi
59+
chmod 700 "$output_dir"
60+
61+
fingerprint_for_email() {
62+
gpg --list-secret-keys --with-colons "$email" 2>/dev/null | awk -F: '$1 == "fpr" {print $10; exit}'
63+
}
64+
65+
fingerprint="$(fingerprint_for_email || true)"
66+
67+
if [[ -z "$fingerprint" ]]; then
68+
printf 'No existing secret key found for %s. Generating one now.\n' "$uid" >&2
69+
if [[ -n "${RELEASE_PLEASE_GPG_PASSPHRASE+x}" ]]; then
70+
gpg --batch --pinentry-mode loopback --passphrase "$RELEASE_PLEASE_GPG_PASSPHRASE" \
71+
--quick-generate-key "$uid" rsa4096 sign 2y
72+
else
73+
gpg --batch --pinentry-mode loopback --passphrase '' \
74+
--quick-generate-key "$uid" rsa4096 sign 2y
75+
fi
76+
fingerprint="$(fingerprint_for_email)"
77+
else
78+
printf 'Using existing secret key for %s.\n' "$uid" >&2
79+
fi
80+
81+
private_key_file="${output_dir}/release-please-private-key.asc"
82+
public_key_file="${output_dir}/release-please-public-key.asc"
83+
key_id_file="${output_dir}/release-please-key-id.txt"
84+
85+
private_key_tmp="${private_key_file}.tmp"
86+
secret_export_args=(--batch --yes --pinentry-mode loopback)
87+
if [[ -n "${RELEASE_PLEASE_GPG_PASSPHRASE+x}" ]]; then
88+
secret_export_args+=(--passphrase "$RELEASE_PLEASE_GPG_PASSPHRASE")
89+
else
90+
secret_export_args+=(--passphrase '')
91+
fi
92+
93+
if ! gpg "${secret_export_args[@]}" --armor --export-secret-keys "$fingerprint" > "$private_key_tmp"; then
94+
rm -f "$private_key_tmp"
95+
if [[ -z "${RELEASE_PLEASE_GPG_PASSPHRASE+x}" ]]; then
96+
printf '\nFailed to export the secret key. If the existing key is passphrase-protected, rerun with:\n' >&2
97+
printf ' RELEASE_PLEASE_GPG_PASSPHRASE=<passphrase> mise run release:signing-key\n' >&2
98+
fi
99+
exit 1
100+
fi
101+
mv "$private_key_tmp" "$private_key_file"
102+
gpg --armor --export "$fingerprint" > "$public_key_file"
103+
printf '%s\n' "$fingerprint" > "$key_id_file"
104+
chmod 600 "$private_key_file" "$key_id_file"
105+
chmod 644 "$public_key_file"
106+
107+
printf '\nGenerated/exported release-please signer values.\n'
108+
printf '\nFiles:\n'
109+
printf ' private key: %s\n' "$private_key_file"
110+
printf ' public key: %s\n' "$public_key_file"
111+
printf ' key id: %s\n' "$key_id_file"
112+
printf ' cleanup: rm -rf %q\n' "$output_dir"
113+
114+
printf '\nGitHub repository secret commands:\n'
115+
printf ' gh secret set RELEASE_PLEASE_GPG_PRIVATE_KEY < %q\n' "$private_key_file"
116+
printf ' gh secret set RELEASE_PLEASE_GPG_KEY_ID --body "$(<%q)"\n' "$key_id_file"
117+
if [[ -n "${RELEASE_PLEASE_GPG_PASSPHRASE+x}" ]]; then
118+
printf ' gh secret set RELEASE_PLEASE_GPG_PASSPHRASE --body %q\n' "$RELEASE_PLEASE_GPG_PASSPHRASE"
119+
else
120+
printf ' # RELEASE_PLEASE_GPG_PASSPHRASE is not needed; generated/using an unprotected key.\n'
121+
fi
122+
123+
printf '\nAdd this public key to GitHub for release-please-signer:\n'
124+
printf ' %s\n' "$public_key_file"
125+
126+
if [[ "$print_values" == "true" ]]; then
127+
printf '\nRELEASE_PLEASE_GPG_KEY_ID:\n'
128+
printf '%s\n' "$fingerprint"
129+
printf '\nRELEASE_PLEASE_GPG_PRIVATE_KEY:\n'
130+
cat "$private_key_file"
131+
printf '\nRELEASE_PLEASE_GPG_PUBLIC_KEY:\n'
132+
cat "$public_key_file"
133+
if [[ -n "${RELEASE_PLEASE_GPG_PASSPHRASE+x}" ]]; then
134+
printf '\nRELEASE_PLEASE_GPG_PASSPHRASE:\n'
135+
printf '%s\n' "$RELEASE_PLEASE_GPG_PASSPHRASE"
136+
fi
137+
fi

0 commit comments

Comments
 (0)