From 14bb6c5a7dca01b8dffecfe3de292d182287c70f Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Mon, 6 Jul 2026 18:33:12 +0530 Subject: [PATCH 1/5] ci: point kattu maven workflows at @develop to test kattu#353 Repoints maven-build / maven-publish-to-nexus / maven-sonar-analysis(-new) reusable-workflow references to mosip/kattu@develop so the GPG-key-import migration (mosip/kattu#353) is exercised by this repo's CI once it merges. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/manual-docker-build.yml | 2 +- .github/workflows/push-trigger.yml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/manual-docker-build.yml b/.github/workflows/manual-docker-build.yml index 2aa31bab6..0b776bc2a 100644 --- a/.github/workflows/manual-docker-build.yml +++ b/.github/workflows/manual-docker-build.yml @@ -12,7 +12,7 @@ on: jobs: build_maven_esignet_with_plugins: - uses: mosip/kattu/.github/workflows/maven-build.yml@master + uses: mosip/kattu/.github/workflows/maven-build.yml@develop with: SERVICE_LOCATION: ./esignet-with-plugins BUILD_ARTIFACT: esignet-with-plugins diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index 69538c353..076f66ef2 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -24,7 +24,7 @@ on: jobs: build_maven_esignet: - uses: mosip/kattu/.github/workflows/maven-build.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-build.yml@develop with: SERVICE_LOCATION: ./ BUILD_ARTIFACT: esignet @@ -108,7 +108,7 @@ jobs: publish_to_nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' }}" needs: build_maven_esignet - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop with: SERVICE_LOCATION: ./ secrets: @@ -122,7 +122,7 @@ jobs: sonar_analysis: needs: build_maven_esignet if: "${{ github.event_name != 'pull_request' }}" - uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@develop with: SERVICE_LOCATION: ./ secrets: @@ -169,7 +169,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_maven_esignet_with_plugins: - uses: mosip/kattu/.github/workflows/maven-build.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-build.yml@develop with: SERVICE_LOCATION: ./esignet-with-plugins BUILD_ARTIFACT: esignet-with-plugins @@ -224,7 +224,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_maven_apitest_esignet: - uses: mosip/kattu/.github/workflows/maven-build.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-build.yml@develop with: SERVICE_LOCATION: ./api-test BUILD_ARTIFACT: apitest-esignet @@ -238,7 +238,7 @@ jobs: publish_to_nexus_apitest_esignet: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build_maven_apitest_esignet - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop with: SERVICE_LOCATION: ./api-test secrets: From 9b7cfc5dcd00083da6ea0cb8cb3a90fca9004473 Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Mon, 6 Jul 2026 19:06:48 +0530 Subject: [PATCH 2/5] ci: pass GPG_PRIVATE_KEY secret from caller workflows (kattu#353) kattu#353 imports the signing key from the GPG_PRIVATE_KEY secret (now required: true in maven-build / maven-publish-to-nexus workflow_call), so the caller must forward it. Added GPG_PRIVATE_KEY to the maven-build and maven-publish-to-nexus caller jobs only (sonar workflows don't declare it). Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/manual-docker-build.yml | 1 + .github/workflows/push-trigger.yml | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/manual-docker-build.yml b/.github/workflows/manual-docker-build.yml index 0b776bc2a..0ff2542d0 100644 --- a/.github/workflows/manual-docker-build.yml +++ b/.github/workflows/manual-docker-build.yml @@ -22,6 +22,7 @@ jobs: OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_dockers_with_esignet_plugins: diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index 076f66ef2..c0d8620f2 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -33,6 +33,7 @@ jobs: OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build-oidc-ui: @@ -117,6 +118,7 @@ jobs: OSSRH_URL: ${{ secrets.OSSRH_SNAPSHOT_URL }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} sonar_analysis: @@ -179,6 +181,7 @@ jobs: OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_dockers_esignet_with_plugins: @@ -233,6 +236,7 @@ jobs: OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} publish_to_nexus_apitest_esignet: @@ -247,6 +251,7 @@ jobs: OSSRH_URL: ${{ secrets.OSSRH_SNAPSHOT_URL }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_apitest_esignet_local: From 17feb3ea459892b5c98f227da3786d6b0ed13ab8 Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Mon, 6 Jul 2026 19:28:18 +0530 Subject: [PATCH 3/5] ci: drop MAVEN_NON_EXEC_ARTIFACTS input for kattu@develop kattu@develop maven-build.yml does not declare MAVEN_NON_EXEC_ARTIFACTS (it was a master-java21-only input), which fails workflow validation. Remove it from the caller so the reusable workflow reference is valid. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/manual-docker-build.yml | 1 - .github/workflows/push-trigger.yml | 1 - 2 files changed, 2 deletions(-) diff --git a/.github/workflows/manual-docker-build.yml b/.github/workflows/manual-docker-build.yml index 0ff2542d0..cbe9ed29e 100644 --- a/.github/workflows/manual-docker-build.yml +++ b/.github/workflows/manual-docker-build.yml @@ -16,7 +16,6 @@ jobs: with: SERVICE_LOCATION: ./esignet-with-plugins BUILD_ARTIFACT: esignet-with-plugins - MAVEN_NON_EXEC_ARTIFACTS: "esignet-mock-plugin.jar,mosip-identity-plugin.jar,sunbird-rc-plugin.jar" secrets: OSSRH_USER: ${{ secrets.OSSRH_USER }} OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index c0d8620f2..41e9fdb8c 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -175,7 +175,6 @@ jobs: with: SERVICE_LOCATION: ./esignet-with-plugins BUILD_ARTIFACT: esignet-with-plugins - MAVEN_NON_EXEC_ARTIFACTS: "esignet-mock-plugin.jar,mosip-identity-plugin.jar,sunbird-rc-plugin.jar" secrets: OSSRH_USER: ${{ secrets.OSSRH_USER }} OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} From 52eeebd4dc3dfc2cef4bfcec9ccbef1cfc411acd Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Tue, 7 Jul 2026 13:37:37 +0530 Subject: [PATCH 4/5] ci: point maven workflows at Mahesh-Binayak/kattu@gpgupdate-masterj21 gpgupdate-masterj21 = master-java21 + the GPG-secret-import / key-age / simplify4u-pgpverify changes, keeping master-java21's interface intact. Repoints maven-build / maven-publish-to-nexus / maven-sonar-analysis to it, restores MAVEN_NON_EXEC_ARTIFACTS, and forwards GPG_PRIVATE_KEY to the build/publish jobs. Other workflows (docker-build, npm-*, sonar-new@develop) and commented refs are left unchanged. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/manual-docker-build.yml | 3 ++- .github/workflows/push-trigger.yml | 13 +++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/workflows/manual-docker-build.yml b/.github/workflows/manual-docker-build.yml index cbe9ed29e..aca125998 100644 --- a/.github/workflows/manual-docker-build.yml +++ b/.github/workflows/manual-docker-build.yml @@ -12,10 +12,11 @@ on: jobs: build_maven_esignet_with_plugins: - uses: mosip/kattu/.github/workflows/maven-build.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./esignet-with-plugins BUILD_ARTIFACT: esignet-with-plugins + MAVEN_NON_EXEC_ARTIFACTS: "esignet-mock-plugin.jar,mosip-identity-plugin.jar,sunbird-rc-plugin.jar" secrets: OSSRH_USER: ${{ secrets.OSSRH_USER }} OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index 41e9fdb8c..9593033f4 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -24,7 +24,7 @@ on: jobs: build_maven_esignet: - uses: mosip/kattu/.github/workflows/maven-build.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./ BUILD_ARTIFACT: esignet @@ -109,7 +109,7 @@ jobs: publish_to_nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' }}" needs: build_maven_esignet - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./ secrets: @@ -124,7 +124,7 @@ jobs: sonar_analysis: needs: build_maven_esignet if: "${{ github.event_name != 'pull_request' }}" - uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./ secrets: @@ -171,10 +171,11 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_maven_esignet_with_plugins: - uses: mosip/kattu/.github/workflows/maven-build.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./esignet-with-plugins BUILD_ARTIFACT: esignet-with-plugins + MAVEN_NON_EXEC_ARTIFACTS: "esignet-mock-plugin.jar,mosip-identity-plugin.jar,sunbird-rc-plugin.jar" secrets: OSSRH_USER: ${{ secrets.OSSRH_USER }} OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} @@ -226,7 +227,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_maven_apitest_esignet: - uses: mosip/kattu/.github/workflows/maven-build.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./api-test BUILD_ARTIFACT: apitest-esignet @@ -241,7 +242,7 @@ jobs: publish_to_nexus_apitest_esignet: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build_maven_apitest_esignet - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./api-test secrets: From 710411ce4f460249e3e591d578c177d5cdb7b936 Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Tue, 7 Jul 2026 17:36:22 +0530 Subject: [PATCH 5/5] ci: point maven workflows at mosip/kattu@gpgupdate-masterj21 The gpgupdate-masterj21 branch (master-java21 + GPG-secret/pgpverify changes) now lives on mosip/kattu, so reference it there instead of the fork. Interface unchanged; GPG_PRIVATE_KEY still forwarded. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/manual-docker-build.yml | 2 +- .github/workflows/push-trigger.yml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/manual-docker-build.yml b/.github/workflows/manual-docker-build.yml index aca125998..83364827e 100644 --- a/.github/workflows/manual-docker-build.yml +++ b/.github/workflows/manual-docker-build.yml @@ -12,7 +12,7 @@ on: jobs: build_maven_esignet_with_plugins: - uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./esignet-with-plugins BUILD_ARTIFACT: esignet-with-plugins diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index 9593033f4..a57f6fcdc 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -24,7 +24,7 @@ on: jobs: build_maven_esignet: - uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./ BUILD_ARTIFACT: esignet @@ -109,7 +109,7 @@ jobs: publish_to_nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' }}" needs: build_maven_esignet - uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./ secrets: @@ -124,7 +124,7 @@ jobs: sonar_analysis: needs: build_maven_esignet if: "${{ github.event_name != 'pull_request' }}" - uses: Mahesh-Binayak/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./ secrets: @@ -171,7 +171,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_maven_esignet_with_plugins: - uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./esignet-with-plugins BUILD_ARTIFACT: esignet-with-plugins @@ -227,7 +227,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build_maven_apitest_esignet: - uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./api-test BUILD_ARTIFACT: apitest-esignet @@ -242,7 +242,7 @@ jobs: publish_to_nexus_apitest_esignet: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build_maven_apitest_esignet - uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./api-test secrets: