Skip to content

Commit a1c8571

Browse files
author
Hendry, Adam
committed
feat(entrypoint.sh): write gpg script
Use bash script to configure the GPG agent, import keys, set the passphrase, and configure Git.
1 parent 94d316f commit a1c8571

File tree

2 files changed

+61
-8
lines changed

2 files changed

+61
-8
lines changed

action.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,15 @@ inputs:
8282
crazy-max/ghaction-import-gpg)
8383
required: false
8484
default: "false"
85-
git_signingkey:
85+
gpg_private_key:
8686
description: >
87-
The UID for the GPG key git will use to sign commits and tags (for git operations). `gpg_sign` must be set to true.
87+
The private gpg signing key for signing commits and tags (for git operations).
88+
Requires `gpg_sign` to be 'true'.
89+
required: false
90+
gpg_passphrase:
91+
description: |
92+
The GPG passphrase for signing commits and tags (for git operations).
93+
Requires `gpg_sign` to be 'true'.
8894
required: false
8995
debug:
9096
description: "If true, prints debug output to GitHub Actions stdout."

entrypoint.sh

Lines changed: 53 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#!/usr/bin/env bash
22

33
set -e
4+
set +o posix
45

56
if [[ -z $INPUT_GITHUB_TOKEN ]]; then
67
echo 'Missing input "github_token: ${{ secrets.GITHUB_TOKEN }}".' >&2
@@ -15,16 +16,62 @@ echo "Git name: $(git config --get user.name)"
1516
echo "Git email: $(git config --get user.email)"
1617

1718
if [[ $INPUT_GPG_SIGN == 'true' ]]; then
18-
if [[ -z $INPUT_GIT_SIGNINGKEY ]]; then
19-
echo 'Missing input "git_signingkey".' >&2
19+
if [[ -z $INPUT_GPG_PRIVATE_KEY ]]; then
20+
echo 'Missing input "gpg_private_key".' >&2
2021
exit 2
2122
fi
22-
echo "Configuring GPG for signing commits and tags..."
23-
git config --local gpg.program gpg
23+
if [[ -z $INPUT_GPG_PASSPHRASE ]]; then
24+
echo 'Missing input "gpg_passphrase".' >&2
25+
exit 3
26+
fi
27+
28+
echo "Configuring GPG agent..."
29+
if [ -f /usr/lib/systemd/user/gpg-agent.service ]; then
30+
mkdir ~/.gnupg
31+
cat <<EOT >> ~/.gnupg/gpg-agent.conf
32+
allow-preset-passphrase
33+
default-cache-ttl 60
34+
max-cache-ttl 50
35+
EOT
36+
chmod 600 ~/.gnupg/*
37+
chmod 700 ~/.gnupg
38+
systemctl --user restart gpg-agent
39+
else
40+
gpg-agent --daemon --allow-preset-passphrase \
41+
--default-cache-ttl 60 --max-cache-ttl 60
42+
fi
43+
44+
echo "Importing GPG key..."
45+
echo -n "${INPUT_GPG_PRIVATE_KEY}" | base64 --decode \
46+
| gpg --pinentry-mode loopback \
47+
--passphrase-file <(echo "${INPUT_GPG_PASSPHRASE}") \
48+
--import
49+
GPG_FINGERPRINT=$(gpg -K --with-fingerprint \
50+
| sed -n 4p | sed -e 's/ *//g')
51+
echo "${GPG_FINGERPRINT}:6:" | gpg --import-ownertrust
52+
53+
echo "Setting GPG passphrase..."
54+
GPG_KEYGRIP=$(gpg --with-keygrip -K \
55+
| sed -n '/[S]/{n;p}' \
56+
| sed 's/Keygrip = //' \
57+
| sed 's/ *//g')
58+
GPG_PASSPHRASE_HEX=$(echo -n "${INPUT_GPG_PASSPHRASE}" \
59+
| od -A n -t x1 \
60+
| tr -d ' ' | tr -d '\n')
61+
echo "PRESET_PASSPHRASE $GPG_KEYGRIP -1 $GPG_PASSPHRASE_HEX" | gpg-connect-agent
62+
63+
echo "Configuring Git for GPG..."
64+
65+
export CI_SIGNINGKEY_UID=$( \
66+
gpg --list-signatures --with-colons \
67+
| grep 'sig' \
68+
| grep "${INPUT_GIT_EMAIL}" \
69+
| head -n 1 \
70+
| cut -d':' -f5 \
71+
)
2472
git config --local commit.gpgsign true
2573
git config --local tag.gpgsign true
26-
git config --local user.signingkey "${INPUT_GIT_SIGNINGKEY}"
27-
echo "Git GPG program: $(git config --get gpg.program)"
74+
git config --local user.signingkey "${CI_SIGNINGKEY_UID}"
2875
echo "Git sign commits?: $(git config --get commit.gpgsign)"
2976
echo "Git sign tags?: $(git config --get tag.gpgsign)"
3077
fi

0 commit comments

Comments
 (0)