ci: migrate GPG key import from committed files to GitHub secret

[Mahesh-Binayak]

• Replace file-based gpg2 import with secret-based import via GPG_PRIVATE_KEY
• Add GPG key age check: warn at 2 years, hard stop at 3 years (bypassable with FORCE_BUILD=true)
• Add simplify4u pgpverify step (non-blocking) to audit external dependency signatures
• Remove unnecessary GPG_TTY env setup
• Applied to maven-build.yml, maven-publish-to-nexus.yml, maven-publish-android.yml

Summary by CodeRabbit

• New Features

  • Added a new build option to let release workflows continue even when signing keys are older than expected.
  • Improved package signing checks during builds to better validate dependency signatures.

• Bug Fixes

  • Updated release workflows to use supplied signing credentials more reliably.
  • Added clearer warnings and blocking behavior when signing keys are nearing expiration or too old.

[coderabbitai]

Warning

Review limit reached

@Mahesh-Binayak, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 3 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 406d5596-2490-4053-ab90-d3a7af118934

📥 Commits

Reviewing files that changed from the base of the PR and between 370cf14 and 61c9b23.

📒 Files selected for processing (4)

• .github/workflows/maven-publish-android.yml
• .github/workflows/maven-publish-to-nexus.yml
• .github/workflows/maven-sonar-analysis-new.yml
• .github/workflows/maven-sonar-analysis.yml

Walkthrough

Three reusable GitHub Actions workflows (maven-build, maven-publish-android, maven-publish-to-nexus) add a FORCE_BUILD input and require a GPG_PRIVATE_KEY secret. GPG setup switches from importing key files to importing keys directly from secrets, with an age check that warns or fails builds based on key age and FORCE_BUILD. maven-build.yml also adds a dependency signature verification step.

Changes

GPG key handling and dependency verification

Layer / File(s)	Summary
maven-build.yml: inputs, GPG setup, and signature verification .github/workflows/maven-build.yml	Adds FORCE_BUILD input and required GPG_PRIVATE_KEY secret; replaces prior key-file import with inline secret import and a 3-year age gate; adds a pgpverify-maven-plugin check step with continue-on-error: true.
maven-publish-android.yml: inputs, GPG import, and age check .github/workflows/maven-publish-android.yml	Adds FORCE_BUILD input and required GPG_PRIVATE_KEY secret; replaces prior setup with conditional key import using GPG_SECRET passphrase and age-based warning/failure logic.
maven-publish-to-nexus.yml: inputs, GPG import, and age check .github/workflows/maven-publish-to-nexus.yml	Adds FORCE_BUILD input and required GPG_PRIVATE_KEY secret; replaces prior GPG setup with conditional key import and age-based warning/failure logic; removes the prior GPG_TTY assignment.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as Maven Workflow
  participant Secrets as GPG_PRIVATE_KEY Secret
  participant GPG as gpg CLI
  participant CI as CI Job Status

  Workflow->>Secrets: Read GPG_PRIVATE_KEY
  Workflow->>GPG: Import key if secret present
  Workflow->>GPG: Query key creation date
  GPG-->>Workflow: Key age
  alt key age > 3 years and FORCE_BUILD != true
    Workflow->>CI: Fail job
  else key age > 3 years and FORCE_BUILD == true
    Workflow->>CI: Emit warning, continue
  else key age > 2 years
    Workflow->>CI: Emit warning, continue
  else
    Workflow->>CI: Continue normally
  end

Loading

Poem

A rabbit checked its keyring's age,
"Three years old? Turn the page!"
With FORCE_BUILD true, we hop along,
Signatures verified, nothing wrong. 🐇🔑
Old keys warned, new keys blessed —
This burrow's builds now pass the test!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main CI change: moving GPG key import from committed files to a GitHub secret.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (1)

.github/workflows/maven-build.yml (1)

66-87: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoff

Age-check block is duplicated verbatim across all three workflows.

The identical import + age-check shell logic appears in maven-build.yml, maven-publish-android.yml, and maven-publish-to-nexus.yml. Consider extracting it into a shared composite action to keep thresholds and messaging in sync. Deferrable.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/maven-build.yml around lines 66 - 87, The GPG key
age-check shell block in this workflow is duplicated in the other Maven
workflows, so centralize the logic into a shared composite action and invoke it
from this job instead. Refactor the repeated `Check GPG key age` step (including
the `FORCE_BUILD` handling and warning/error thresholds) into one reusable
action so `maven-build.yml`, `maven-publish-android.yml`, and
`maven-publish-to-nexus.yml` stay consistent.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/maven-build.yml:
- Around line 12-15: The `FORCE_BUILD` workflow input in the maven build/publish
workflows is defaulting to true, which disables the 3-year hard-stop unless
callers override it. Update the workflow input definition for `FORCE_BUILD` in
the affected workflow files so the default is false, and keep the existing
age-check logic in the build step that gates on `FORCE_BUILD != "true"` aligned
with this default. Use the `FORCE_BUILD` input blocks and the age-enforcement
step in `maven-build.yml`, `maven-publish-android.yml`, and
`maven-publish-to-nexus.yml` as the places to adjust.

In @.github/workflows/maven-publish-android.yml:
- Around line 15-19: The workflow has a duplicate inputs mapping under
workflow_call, which causes one of the defined inputs to be dropped and breaks
downstream references like FORCE_BUILD. Merge FORCE_BUILD into the existing
inputs block in the maven-publish-android workflow, keeping the original inputs
such as SERVICE_LOCATION intact, and remove the second inputs key so the YAML
has only one inputs mapping.

In @.github/workflows/maven-publish-to-nexus.yml:
- Around line 9-13: The workflow has a duplicate inputs mapping under
workflow_call, which causes one set of inputs to be dropped and breaks
FORCE_BUILD resolution. Update the existing inputs block in
maven-publish-to-nexus.yml to include FORCE_BUILD alongside the other declared
inputs, and remove the second inputs key entirely so the workflow schema remains
valid and the referenced force_build input is defined for the job that uses it.

---

Nitpick comments:
In @.github/workflows/maven-build.yml:
- Around line 66-87: The GPG key age-check shell block in this workflow is
duplicated in the other Maven workflows, so centralize the logic into a shared
composite action and invoke it from this job instead. Refactor the repeated
`Check GPG key age` step (including the `FORCE_BUILD` handling and warning/error
thresholds) into one reusable action so `maven-build.yml`,
`maven-publish-android.yml`, and `maven-publish-to-nexus.yml` stay consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d1349d57-9e88-4a41-a0e5-8b346b7a963c

📥 Commits

Reviewing files that changed from the base of the PR and between 8d1f8bd and 370cf14.

📒 Files selected for processing (3)

• .github/workflows/maven-build.yml
• .github/workflows/maven-publish-android.yml
• .github/workflows/maven-publish-to-nexus.yml

[Varaniya201]

Approved