Skip to content

gpgupdate-masterj21 changes so we can test the changes in master-java21 branch. #354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Prafulrakhade merged 2 commits into from
Jul 7, 2026
Merged

gpgupdate-masterj21 changes so we can test the changes in master-java21 branch. #354

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
efd6389
ci: migrate GPG key import to GitHub secret and skip GPG in sonar
Mahesh-Binayak Jul 6, 2026
6cac9f5
ci: use SONAR_TOKEN secret in sonar analysis
Mahesh-Binayak Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 47 additions & 10 deletions .github/workflows/maven-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,11 @@ on:
type: string
MAVEN_NON_EXEC_ARTIFACTS:
required: false
type: string
type: string
FORCE_BUILD:
required: false
type: string
default: 'true'
Comment thread
Mahesh-Binayak marked this conversation as resolved.
secrets:
OSSRH_USER:
required: true
Expand All @@ -21,6 +25,8 @@ on:
required: true
GPG_SECRET:
required: true
GPG_PRIVATE_KEY:
required: true
SLACK_WEBHOOK_URL:
required: true

Expand All @@ -47,18 +53,41 @@ jobs:

- name: Setup branch and env
run: |
# Strip git ref prefix from version
echo "BRANCH_NAME=$(echo ${{ github.ref }} | sed -e 's,.*/\(.*\),\1,')" >> $GITHUB_ENV
echo "GPG_TTY=$(tty)" >> $GITHUB_ENV

- name: Setup branch and GPG public key
- name: Import GPG key
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_SECRET: ${{ secrets.GPG_SECRET }}
run: |
if [ -n "$GPG_PRIVATE_KEY" ]; then
echo "$GPG_PRIVATE_KEY" | gpg --batch --passphrase "$GPG_SECRET" --pinentry-mode loopback --import
else
echo "GPG_PRIVATE_KEY not set, skipping import"
fi

- name: Check GPG key age
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
FORCE_BUILD: ${{ inputs.FORCE_BUILD }}
run: |
# Strip git ref prefix from version
echo ${{ env.BRANCH_NAME }}
echo ${{ env.GPG_TTY }}
sudo apt-get --yes install gnupg2
gpg2 --import ./.github/keys/mosipgpgkey_pub.gpg
gpg2 --quiet --batch --passphrase=${{secrets.GPG_SECRET}} --allow-secret-key-import --import ./.github/keys/mosipgpgkey_sec.gpg
if [ -z "$GPG_PRIVATE_KEY" ]; then exit 0; fi
CREATED=$(gpg --list-keys --with-colons 2>/dev/null | awk -F: '/^pub/{print $6; exit}')
if [ -z "$CREATED" ]; then exit 0; fi
NOW=$(date +%s)
AGE_DAYS=$(( (NOW - CREATED) / 86400 ))
AGE_YEARS=$(echo "scale=1; $AGE_DAYS / 365" | bc)
echo "GPG key age: $AGE_DAYS days (~$AGE_YEARS years)"
if [ $AGE_DAYS -gt 1095 ]; then
if [ "$FORCE_BUILD" = "true" ]; then
echo "::warning::GPG key is over 3 years old ($AGE_YEARS years). FORCE_BUILD=true — KEY ROTATION IS OVERDUE."
else
echo "::error::GPG key is over 3 years old ($AGE_YEARS years). Rotate the key or set FORCE_BUILD=true to override."
exit 1
fi
elif [ $AGE_DAYS -gt 730 ]; then
echo "::warning::GPG key is over 2 years old ($AGE_YEARS years). Schedule key rotation soon."
fi

- name: Install xmlstartlet and xmllint
run: |
Expand Down Expand Up @@ -101,6 +130,14 @@ jobs:
xmllint --xpath '/*[local-name()="project"]/*[local-name()="version"]' $F
done

- name: Verify dependency signatures (simplify4u pgpverify)
continue-on-error: true
run: |
cd ${{ inputs.SERVICE_LOCATION }} && mvn org.simplify4u.plugins:pgpverify-maven-plugin:1.19.1:check \
-DfailNoSignature=false \
-DverifySnapshots=false \
-s $GITHUB_WORKSPACE/settings.xml
Comment thread
Mahesh-Binayak marked this conversation as resolved.

- name: Build with Maven
run: cd ${{ inputs.SERVICE_LOCATION }} && mvn -U -B package -Dmaven.wagon.http.retryHandler.count=2 --file pom.xml -s $GITHUB_WORKSPACE/settings.xml

Expand Down
47 changes: 38 additions & 9 deletions .github/workflows/maven-publish-android.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@ on:
required: true
default: "android"
type: string
FORCE_BUILD:
required: false
type: string
default: 'true'
Comment thread
Mahesh-Binayak marked this conversation as resolved.
secrets:
OSSRH_USER:
required: true
Expand All @@ -23,6 +27,8 @@ on:
required: true
GPG_SECRET:
required: true
GPG_PRIVATE_KEY:
required: true
SLACK_WEBHOOK_URL:
required: true

Expand Down Expand Up @@ -77,18 +83,41 @@ jobs:

- name: Setup branch and env
run: |
# Strip git ref prefix from version
echo "BRANCH_NAME=$(echo ${{ github.ref }} | sed -e 's,.*/\(.*\),\1,')" >> $GITHUB_ENV
echo "GPG_TTY=$(tty)" >> $GITHUB_ENV

- name: Setup branch and GPG public key
- name: Import GPG key
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_SECRET: ${{ secrets.GPG_SECRET }}
run: |
if [ -n "$GPG_PRIVATE_KEY" ]; then
echo "$GPG_PRIVATE_KEY" | gpg --batch --passphrase "$GPG_SECRET" --pinentry-mode loopback --import
else
echo "GPG_PRIVATE_KEY not set, skipping import"
fi

- name: Check GPG key age
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
FORCE_BUILD: ${{ inputs.FORCE_BUILD }}
run: |
# Strip git ref prefix from version
echo ${{ env.BRANCH_NAME }}
echo ${{ env.GPG_TTY }}
sudo apt-get --yes install gnupg2
gpg2 --import ./.github/keys/mosipgpgkey_pub.gpg
gpg2 --quiet --batch --passphrase=${{secrets.GPG_SECRET}} --allow-secret-key-import --import ./.github/keys/mosipgpgkey_sec.gpg
if [ -z "$GPG_PRIVATE_KEY" ]; then exit 0; fi
CREATED=$(gpg --list-keys --with-colons 2>/dev/null | awk -F: '/^pub/{print $6; exit}')
if [ -z "$CREATED" ]; then exit 0; fi
NOW=$(date +%s)
AGE_DAYS=$(( (NOW - CREATED) / 86400 ))
AGE_YEARS=$(echo "scale=1; $AGE_DAYS / 365" | bc)
echo "GPG key age: $AGE_DAYS days (~$AGE_YEARS years)"
if [ $AGE_DAYS -gt 1095 ]; then
if [ "$FORCE_BUILD" = "true" ]; then
echo "::warning::GPG key is over 3 years old ($AGE_YEARS years). FORCE_BUILD=true — KEY ROTATION IS OVERDUE."
else
echo "::error::GPG key is over 3 years old ($AGE_YEARS years). Rotate the key or set FORCE_BUILD=true to override."
exit 1
fi
elif [ $AGE_DAYS -gt 730 ]; then
echo "::warning::GPG key is over 2 years old ($AGE_YEARS years). Schedule key rotation soon."
fi

- name: Install xmlstartlet and xmllint
run: |
Expand Down
49 changes: 38 additions & 11 deletions .github/workflows/maven-publish-to-nexus.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ on:
SERVICE_LOCATION:
required: true
type: string
FORCE_BUILD:
required: false
type: string
default: 'true'
Comment thread
Mahesh-Binayak marked this conversation as resolved.
secrets:
OSSRH_USER:
required: true
Expand All @@ -17,6 +21,8 @@ on:
required: true
GPG_SECRET:
required: true
GPG_PRIVATE_KEY:
required: true
SLACK_WEBHOOK_URL:
required: false

Expand Down Expand Up @@ -44,18 +50,41 @@ jobs:

- name: Setup branch and env
run: |
# Strip git ref prefix from version
echo "BRANCH_NAME=$(echo ${{ github.ref }} | sed -e 's,.*/\(.*\),\1,')" >> $GITHUB_ENV
echo "GPG_TTY=$(tty)" >> $GITHUB_ENV

- name: Setup branch and GPG public key
- name: Import GPG key
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_SECRET: ${{ secrets.GPG_SECRET }}
run: |
if [ -n "$GPG_PRIVATE_KEY" ]; then
echo "$GPG_PRIVATE_KEY" | gpg --batch --passphrase "$GPG_SECRET" --pinentry-mode loopback --import
else
echo "GPG_PRIVATE_KEY not set, skipping import"
fi

- name: Check GPG key age
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
FORCE_BUILD: ${{ inputs.FORCE_BUILD }}
run: |
# Strip git ref prefix from version
echo ${{ env.BRANCH_NAME }}
echo ${{ env.GPG_TTY }}
sudo apt-get --yes install gnupg2
gpg2 --import ./.github/keys/mosipgpgkey_pub.gpg
gpg2 --quiet --batch --passphrase=${{secrets.GPG_SECRET}} --allow-secret-key-import --import ./.github/keys/mosipgpgkey_sec.gpg
if [ -z "$GPG_PRIVATE_KEY" ]; then exit 0; fi
CREATED=$(gpg --list-keys --with-colons 2>/dev/null | awk -F: '/^pub/{print $6; exit}')
if [ -z "$CREATED" ]; then exit 0; fi
NOW=$(date +%s)
AGE_DAYS=$(( (NOW - CREATED) / 86400 ))
AGE_YEARS=$(echo "scale=1; $AGE_DAYS / 365" | bc)
echo "GPG key age: $AGE_DAYS days (~$AGE_YEARS years)"
if [ $AGE_DAYS -gt 1095 ]; then
if [ "$FORCE_BUILD" = "true" ]; then
echo "::warning::GPG key is over 3 years old ($AGE_YEARS years). FORCE_BUILD=true — KEY ROTATION IS OVERDUE."
else
echo "::error::GPG key is over 3 years old ($AGE_YEARS years). Rotate the key or set FORCE_BUILD=true to override."
exit 1
fi
elif [ $AGE_DAYS -gt 730 ]; then
echo "::warning::GPG key is over 2 years old ($AGE_YEARS years). Schedule key rotation soon."
fi

- name: Setup the settings file for ossrh server
run: echo "<settings> <servers> <server> <id>ossrh</id> <username>${{secrets.OSSRH_USER}}</username> <password>${{secrets.OSSRH_SECRET}}</password> </server> </servers> <profiles> <profile> <id>ossrh</id> <activation> <activeByDefault>true</activeByDefault> </activation> <properties> <gpg.executable>gpg2</gpg.executable> <gpg.passphrase>${{secrets.GPG_SECRET}}</gpg.passphrase> </properties> </profile> <profile> <id>allow-snapshots</id> <activation><activeByDefault>true</activeByDefault></activation> <repositories> <repository> <id>snapshots-repo</id> <url>https://central.sonatype.com/repository/maven-snapshots</url> <releases><enabled>false</enabled></releases> <snapshots><enabled>true</enabled></snapshots> </repository> <repository> <id>releases-repo</id> <url>https://central.sonatype.com/api/v1/publisher</url> <releases><enabled>true</enabled></releases> <snapshots><enabled>false</enabled></snapshots> </repository> <repository> <id>danubetech-maven-public</id> <url>https://repo.danubetech.com/repository/maven-public/</url> </repository> </repositories> </profile> <profile> <id>sonar</id> <properties> <sonar.sources>.</sonar.sources> <sonar.host.url>https://sonarcloud.io</sonar.host.url> </properties> <activation> <activeByDefault>false</activeByDefault> </activation> </profile> </profiles> </settings>" > $GITHUB_WORKSPACE/settings.xml
Expand All @@ -66,8 +95,6 @@ jobs:
- name: Publish the maven package
run: |
cd ${{ inputs.SERVICE_LOCATION }} && mvn -DskipTests -U -B deploy -Dmaven.wagon.http.retryHandler.count=2 -DaltDeploymentRepository=ossrh::default::${{ secrets.OSSRH_URL }} -s $GITHUB_WORKSPACE/settings.xml -f pom.xml
env:
GPG_TTY: $(tty)

# - uses: 8398a7/action-slack@v3
# with:
Expand Down
13 changes: 1 addition & 12 deletions .github/workflows/maven-sonar-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,20 +53,9 @@ jobs:

- name: Setup branch and env
run: |
# Strip git ref prefix from version
echo "BRANCH_NAME=$(echo ${{ github.ref }} | sed -e 's,.*/\(.*\),\1,')" >> $GITHUB_ENV
echo "GPG_TTY=$(tty)" >> $GITHUB_ENV
echo "SONAR URL : ${{ inputs.SONAR_URL }}"

- name: Setup branch and GPG public key
run: |
# Strip git ref prefix from version
echo ${{ env.BRANCH_NAME }}
echo ${{ env.GPG_TTY }}
sudo apt-get --yes install gnupg2
gpg2 --import ./.github/keys/mosipgpgkey_pub.gpg
gpg2 --quiet --batch --passphrase=${{secrets.GPG_SECRET}} --allow-secret-key-import --import ./.github/keys/mosipgpgkey_sec.gpg

- name: Setup the settings file for ossrh server
run: echo "<settings><servers><server><id>ossrh</id><username>${{secrets.OSSRH_USER}}</username><password>${{secrets.OSSRH_SECRET}}</password></server></servers><profiles><profile><id>ossrh</id><activation><activeByDefault>true</activeByDefault></activation><properties><gpg.executable>gpg2</gpg.executable><gpg.passphrase>${{secrets.GPG_SECRET}}</gpg.passphrase></properties></profile><profile><id>allow-snapshots</id><activation><activeByDefault>true</activeByDefault></activation><repositories><repository><id>snapshots-repo</id><url>https://central.sonatype.com/repository/maven-snapshots</url><releases><enabled>false</enabled></releases><snapshots><enabled>true</enabled></snapshots></repository><repository><id>releases-repo</id><url>https://central.sonatype.com/api/v1/publisher</url><releases><enabled>true</enabled></releases><snapshots><enabled>false</enabled></snapshots></repository><repository><id>danubetech-maven-public</id><url>https://repo.danubetech.com/repository/maven-public/</url></repository><repository><id>nexus-snapshots</id><url>https://oss.sonatype.org/content/repositories/snapshots</url></repository></repositories></profile><profile><id>sonar</id><properties><sonar.sources>.</sonar.sources><sonar.host.url>https://sonarcloud.io</sonar.host.url></properties><activation><activeByDefault>false</activeByDefault></activation></profile></profiles></settings>" > $GITHUB_WORKSPACE/settings.xml

Expand All @@ -75,7 +64,7 @@ jobs:

- name: Analyze with SonarCloud
run: |
cd ${{ inputs.SERVICE_LOCATION }} && mvn -Psonar -U -B verify sonar:sonar -Dmaven.wagon.http.retryHandler.count=2 -Dsonar.projectKey=${{ inputs.PROJECT_KEY }} -Dsonar.organization=${{ secrets.ORG_KEY }} -Dsonar.host.url=${{ inputs.SONAR_URL }} -Dsonar.token=${{ secrets.SONAR_TOKEN1 }} -Dsonar.projectName=${{ github.event.repository.name }} --file pom.xml -s $GITHUB_WORKSPACE/settings.xml
cd ${{ inputs.SERVICE_LOCATION }} && mvn -Psonar -U -B verify sonar:sonar -Dgpg.skip=true -Dmaven.wagon.http.retryHandler.count=2 -Dsonar.projectKey=${{ inputs.PROJECT_KEY }} -Dsonar.organization=${{ secrets.ORG_KEY }} -Dsonar.host.url=${{ inputs.SONAR_URL }} -Dsonar.token=${{ secrets.SONAR_TOKEN }} -Dsonar.projectName=${{ github.event.repository.name }} --file pom.xml -s $GITHUB_WORKSPACE/settings.xml
Comment thread
Mahesh-Binayak marked this conversation as resolved.
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
Expand Down