Fix release GitHub action (#126)

sbt-ci-release's setupGpg runs

    echo $PGP_SECRET | base64 --decode | gpg --import

so it expects PGP_SECRET to be a base64-encoded blob. The existing
GitHub PGP_SECRET secret instead holds the raw armored PGP key — the
format Gradle's useInMemoryPgpKeys consumed before the SBT migration.
The first release attempt after the migration therefore failed with

    java.lang.RuntimeException: base64: invalid input
        at com.geirsson.CiReleasePlugin$.setupGpg(CiReleasePlugin.scala:95)

Re-encode the armored key to base64 inline in the workflow so the
GitHub secret can stay in its current form (kept compatible with any
other consumers) and the encoded value never lands in logs, files or
GITHUB_ENV — it lives only in the publish step's shell process.

Author: jupblb

.github/workflows/release.yml

@@ -17,9 +17,14 @@ jobs:
           cache: 'sbt'
       - uses: sbt/setup-sbt@v1
       - name: Publish ${{ github.ref }}
-        run: sbt ci-release
         env:
           SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
           SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
-          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+          # The secret stores the armored PGP key (the format Gradle's
+          # useInMemoryPgpKeys consumed). sbt-ci-release expects a base64
+          # blob, so re-encode it inline before invoking sbt.
+          PGP_SECRET_ARMORED: ${{ secrets.PGP_SECRET }}
           PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
+        run: |
+          export PGP_SECRET="$(printf '%s' "$PGP_SECRET_ARMORED" | base64 -w0)"
+          sbt ci-release