1
1
#! /usr/bin/env bash
2
2
3
3
set -e
4
+ set +o posix
4
5
5
6
if [[ -z $INPUT_GITHUB_TOKEN ]]; then
6
7
echo ' Missing input "github_token: ${{ secrets.GITHUB_TOKEN }}".' >&2
@@ -15,16 +16,62 @@ echo "Git name: $(git config --get user.name)"
15
16
echo " Git email: $( git config --get user.email) "
16
17
17
18
if [[ $INPUT_GPG_SIGN == ' true' ]]; then
18
- if [[ -z $INPUT_GIT_SIGNINGKEY ]]; then
19
- echo ' Missing input "git_signingkey ".' >&2
19
+ if [[ -z $INPUT_GPG_PRIVATE_KEY ]]; then
20
+ echo ' Missing input "gpg_private_key ".' >&2
20
21
exit 2
21
22
fi
22
- echo " Configuring GPG for signing commits and tags..."
23
- git config --local gpg.program gpg
23
+ if [[ -z $INPUT_GPG_PASSPHRASE ]]; then
24
+ echo ' Missing input "gpg_passphrase".' >&2
25
+ exit 3
26
+ fi
27
+
28
+ echo " Configuring GPG agent..."
29
+ if [ -f /usr/lib/systemd/user/gpg-agent.service ]; then
30
+ mkdir ~ /.gnupg
31
+ cat << EOT >> ~/.gnupg/gpg-agent.conf
32
+ allow-preset-passphrase
33
+ default-cache-ttl 60
34
+ max-cache-ttl 50
35
+ EOT
36
+ chmod 600 ~ /.gnupg/*
37
+ chmod 700 ~ /.gnupg
38
+ systemctl --user restart gpg-agent
39
+ else
40
+ gpg-agent --daemon --allow-preset-passphrase \
41
+ --default-cache-ttl 60 --max-cache-ttl 60
42
+ fi
43
+
44
+ echo " Importing GPG key..."
45
+ echo -n " ${INPUT_GPG_PRIVATE_KEY} " | base64 --decode \
46
+ | gpg --pinentry-mode loopback \
47
+ --passphrase-file <( echo " ${INPUT_GPG_PASSPHRASE} " ) \
48
+ --import
49
+ GPG_FINGERPRINT=$( gpg -K --with-fingerprint \
50
+ | sed -n 4p | sed -e ' s/ *//g' )
51
+ echo " ${GPG_FINGERPRINT} :6:" | gpg --import-ownertrust
52
+
53
+ echo " Setting GPG passphrase..."
54
+ GPG_KEYGRIP=$( gpg --with-keygrip -K \
55
+ | sed -n ' /[S]/{n;p}' \
56
+ | sed ' s/Keygrip = //' \
57
+ | sed ' s/ *//g' )
58
+ GPG_PASSPHRASE_HEX=$( echo -n " ${INPUT_GPG_PASSPHRASE} " \
59
+ | od -A n -t x1 \
60
+ | tr -d ' ' | tr -d ' \n' )
61
+ echo " PRESET_PASSPHRASE $GPG_KEYGRIP -1 $GPG_PASSPHRASE_HEX " | gpg-connect-agent
62
+
63
+ echo " Configuring Git for GPG..."
64
+
65
+ export CI_SIGNINGKEY_UID=$( \
66
+ gpg --list-signatures --with-colons \
67
+ | grep ' sig' \
68
+ | grep " ${INPUT_GIT_EMAIL} " \
69
+ | head -n 1 \
70
+ | cut -d' :' -f5 \
71
+ )
24
72
git config --local commit.gpgsign true
25
73
git config --local tag.gpgsign true
26
- git config --local user.signingkey " ${INPUT_GIT_SIGNINGKEY} "
27
- echo " Git GPG program: $( git config --get gpg.program) "
74
+ git config --local user.signingkey " ${CI_SIGNINGKEY_UID} "
28
75
echo " Git sign commits?: $( git config --get commit.gpgsign) "
29
76
echo " Git sign tags?: $( git config --get tag.gpgsign) "
30
77
fi
0 commit comments