Fix GPG secret handling: use passphrase-file and restrict secrets to tag runs

Author: Copilot

.github/workflows/release.yaml

@@ -36,6 +36,12 @@ jobs:
         name: Import GPG key
         if: ${{ startsWith(github.ref, 'refs/tags/v') }}
         run: echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 --decode | gpg --batch --import
+      -
+        name: Set GPG environment for signing
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          echo "GPG_FINGERPRINT=${{ secrets.GPG_FINGERPRINT }}" >> "$GITHUB_ENV"
+          echo "GPG_PASSPHRASE=${{ secrets.GPG_PASSPHRASE }}" >> "$GITHUB_ENV"
       -
         name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
@@ -45,5 +51,3 @@ jobs:
           args: release --clean ${{ env.flags }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

.goreleaser.yml

@@ -65,11 +65,15 @@ signs:
         signature="$2"
         filename="$(basename "$artifact")"
         digest="$(sha256sum "$artifact" | cut -d' ' -f1)"
+        passphrase_file="$(mktemp)"
+        trap 'rm -f "$passphrase_file"' EXIT
+        printf '%s' "${GPG_PASSPHRASE:-}" > "$passphrase_file"
+        chmod 600 "$passphrase_file"
         {
           cat plugin.yaml
           printf '\n...\n'
           printf 'files:\n  %s: "sha256:%s"\n' "$filename" "$digest"
-        } | gpg --batch --yes --armor --pinentry-mode loopback --passphrase "${GPG_PASSPHRASE:-}" --local-user "$GPG_FINGERPRINT" --clearsign --output "$signature"
+        } | gpg --batch --yes --armor --pinentry-mode loopback --passphrase-file "$passphrase_file" --local-user "$GPG_FINGERPRINT" --clearsign --output "$signature"
       - --
       - ${artifact}
       - ${signature}