gpgupdate-masterj21 changes so we can test the changes in master-java21 branch.

[Mahesh-Binayak]

Summary by CodeRabbit

• Chores

  • Updated Maven build and publish workflows to use a new signing key setup from secure secrets.
  • Added optional build override support for older signing keys.
  • Improved signature verification during Maven builds.

• Bug Fixes

  • Streamlined Sonar analysis authentication to use the correct token source.
  • Removed reliance on repository-stored key files in CI workflows.

[coderabbitai]

Walkthrough

Four GitHub Actions Maven workflows are updated to import GPG signing keys from a new GPG_PRIVATE_KEY secret instead of repository files, enforce key-age validation gated by a new FORCE_BUILD input, add a pgpverify check step in maven-build.yml, and simplify GPG/token handling in maven-sonar-analysis.yml.

Changes

Maven/Sonar Workflow GPG Handling

Layer / File(s)	Summary
maven-build.yml: secret-based import, key-age gate, pgpverify check .github/workflows/maven-build.yml	Adds FORCE_BUILD input and required GPG_PRIVATE_KEY secret; replaces file-based GPG setup with secret import and 2/3-year age warnings/failures; adds pgpverify-maven-plugin check step with continue-on-error.
maven-publish-android.yml: secret-based import, key-age gate .github/workflows/maven-publish-android.yml	Adds FORCE_BUILD and GPG_PRIVATE_KEY inputs; replaces GPG_TTY/file-based key import with secret-based import and age validation that fails builds on keys older than 3 years unless forced.
maven-publish-to-nexus.yml: secret-based import, key-age gate .github/workflows/maven-publish-to-nexus.yml	Adds FORCE_BUILD input and required GPG_PRIVATE_KEY secret; replaces GPG setup with secret-based import and age-gated failure/warning; removes prior GPG_TTY assignment.
maven-sonar-analysis.yml: simplified setup and token .github/workflows/maven-sonar-analysis.yml	Simplifies setup step to only set BRANCH_NAME/print SONAR_URL, removes GPG_TTY export and key import step, and switches -Dsonar.token to secrets.SONAR_TOKEN.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant Secrets
  participant GPG as gpg CLI
  participant Maven

  Workflow->>Secrets: read GPG_PRIVATE_KEY, GPG_SECRET
  Workflow->>GPG: import private key with passphrase
  Workflow->>GPG: list-keys to determine creation date
  GPG-->>Workflow: key age
  alt key older than 3 years and FORCE_BUILD != true
    Workflow->>Workflow: fail workflow
  else key older than 2 years
    Workflow->>Workflow: emit warning
  else key within threshold
    Workflow->>Maven: proceed with build/signing
  end

Loading

Possibly related PRs

• mosip/kattu#336: Both PRs modify the SonarCloud analysis workflow's GPG setup and sonar.token handling.
• mosip/kattu#353: Updates the same Maven/Android/Nexus workflows with matching secret-based GPG import, FORCE_BUILD gating, and pgpverify check logic.

Suggested reviewers: ckm007, Varaniya201

Poem

A rabbit hops through YAML fields so wide,
Old GPG keys from files now cast aside.
Secrets whisper in, age checked with care,
FORCE_BUILD stands guard when years lay bare.
pgpverify hums a signature tune —
hop, hop, hooray, the pipeline's in bloom! 🐇🔐

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to the branch/workflow changes, but it is vague and describes testing rather than the actual update.	Rename it to describe the main change, for example: "Update Maven workflows to use GPG secrets and Sonar token".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Mahesh-Binayak]

@CodeRabbit review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/maven-build.yml:
- Around line 15-18: The FORCE_BUILD input is defaulting to the non-enforcing
path, which makes stale keys only warn instead of stopping the build. Update the
workflow input definition for FORCE_BUILD so the default reflects enforcement
mode, and make sure any logic that reads FORCE_BUILD continues to treat the
default as the hard-stop behavior unless callers explicitly override it.
- Around line 136-139: The Maven step is interpolating inputs.SERVICE_LOCATION
directly inside the shell command, which should be avoided. Update the workflow
step in the maven build job to pass SERVICE_LOCATION through env and reference
that variable in the run block, quoting it when used with cd; this keeps the
shell from treating caller-controlled input as command syntax. Refer to the
maven-build workflow step that invokes mvn with the pgpverify-maven-plugin.

In @.github/workflows/maven-publish-android.yml:
- Around line 15-18: The workflow input FORCE_BUILD is defaulting to the
override path, which bypasses the key-age enforcement by default. Update the
workflow’s FORCE_BUILD input definition in the maven-publish-android pipeline to
default to 'false' so enforcement is the default behavior, and keep any existing
logic that checks FORCE_BUILD aligned with this value.

In @.github/workflows/maven-publish-to-nexus.yml:
- Around line 9-12: The workflow input FORCE_BUILD is defaulting to the wrong
mode, which makes the enforcement path opt-out instead of deliberate. Update the
workflow input definition so the FORCE_BUILD default is set to false, and keep
the existing input name and type in the maven-publish-to-nexus workflow so
callers must explicitly opt in to force builds.

In @.github/workflows/maven-sonar-analysis.yml:
- Line 67: The Maven sonar step is interpolating caller-controlled values
directly in the shell command, which can lead to shell template injection. Move
the `${{ inputs.SERVICE_LOCATION }}`, `${{ inputs.PROJECT_KEY }}`, `${{
inputs.SONAR_URL }}`, `${{ secrets.ORG_KEY }}`, `${{ secrets.SONAR_TOKEN }}`,
and `${{ github.event.repository.name }}` values into `env` for the workflow
step, then reference those environment variables in the `run` command with
quoted shell variables. Keep the existing `mvn` invocation in the same workflow
job, but ensure the `run` script uses only `$VAR` references so the shell treats
the values as data.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c3dd745a-36cd-453d-9ab9-f5822aae020b

📥 Commits

Reviewing files that changed from the base of the PR and between 201656d and 6cac9f5.

📒 Files selected for processing (4)

• .github/workflows/maven-build.yml
• .github/workflows/maven-publish-android.yml
• .github/workflows/maven-publish-to-nexus.yml
• .github/workflows/maven-sonar-analysis.yml