Keep GPG_PASSPHRASE default for v5 compatibility

Revert the gpg-passphrase input default back to GPG_PASSPHRASE so existing v5
workflows that set the GPG_PASSPHRASE environment variable keep working without
changes. setup-java writes gpg.passphraseEnvName=GPG_PASSPHRASE into an active
profile, so the maven-gpg-plugin reads the same variable as before.

The only remaining compatibility requirement is maven-gpg-plugin 3.2.0+, which
is documented in the README and advanced usage guide.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1

README.md

@@ -24,9 +24,7 @@ This action allows you to work with Java and Scala projects.
 
 ## Breaking changes in V6
 
-- **GPG passphrase is now passed to the Maven GPG Plugin via an environment variable instead of a `settings.xml` server.** setup-java no longer writes the deprecated `gpg.passphrase` server to `settings.xml`; it relies on the plugin's `gpg.passphraseEnvName` mechanism instead. As part of this:
-  - The default value of the `gpg-passphrase` input changed from `GPG_PASSPHRASE` to `MAVEN_GPG_PASSPHRASE` (the Maven GPG Plugin default). If you relied on the old default, set a `MAVEN_GPG_PASSPHRASE` environment variable in your build step, or pass `gpg-passphrase: GPG_PASSPHRASE` explicitly to keep the previous name.
-  - This requires `maven-gpg-plugin` **3.2.0 or newer**. Older versions do not honor `gpg.passphraseEnvName` and will no longer pick up the passphrase, since the `gpg.passphrase` server is no longer written. Upgrade the plugin to 3.2.0+.
+- **The GPG passphrase is now passed to the Maven GPG Plugin through an environment variable (`gpg.passphraseEnvName`) instead of the deprecated `gpg.passphrase` server in `settings.xml`.** The `gpg-passphrase` input and its default (`GPG_PASSPHRASE`) are unchanged, so if you already set that environment variable in your build step your workflow keeps working. However, this now requires `maven-gpg-plugin` **3.2.0 or newer**; older versions do not honor `gpg.passphraseEnvName` and, because the `gpg.passphrase` server is no longer written, will not pick up the passphrase. Upgrade the plugin to 3.2.0+.
 
   See [GPG](docs/advanced-usage.md#gpg) for details.
 
@@ -78,7 +76,7 @@ For more details,  see the full release notes on the [releases page](https://git
 
   - `gpg-private-key`: GPG private key to import. Default is empty string.
 
-  - `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is MAVEN_GPG_PASSPHRASE.
+  - `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is GPG_PASSPHRASE.
 
   - `mvn-toolchain-id`: Name of Maven Toolchain ID if the default name of `${distribution}_${java-version}` is not wanted.
 

action.yml

@@ -68,7 +68,7 @@ inputs:
     required: false
     default: ''
   gpg-passphrase:
-    description: 'Environment variable name for the GPG private key passphrase. Defaults to MAVEN_GPG_PASSPHRASE when gpg-private-key is set; ignored otherwise.'
+    description: 'Environment variable name for the GPG private key passphrase. Defaults to GPG_PASSPHRASE when gpg-private-key is set; ignored otherwise.'
     required: false
   cache:
     description: 'Name of the build platform to cache dependencies. It can be "maven", "gradle" or "sbt".'

dist/cleanup/index.js

@@ -95848,7 +95848,7 @@ const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings';
 const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
 const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
 const INPUT_DEFAULT_GPG_PRIVATE_KEY = (/* unused pure expression or super */ null && (undefined));
-const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE';
+const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
 // The default name of the environment variable the maven-gpg-plugin reads the
 // passphrase from (property `gpg.passphraseEnvName`). When the configured
 // passphrase env var name matches this, no extra configuration is required.

dist/setup/index.js

@@ -73293,7 +73293,7 @@ const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings';
 const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
 const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
 const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined;
-const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE';
+const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
 // The default name of the environment variable the maven-gpg-plugin reads the
 // passphrase from (property `gpg.passphraseEnvName`). When the configured
 // passphrase env var name matches this, no extra configuration is required.

docs/advanced-usage.md

@@ -682,10 +682,10 @@ If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `
         MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
 ```
 
-The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). It defaults to `MAVEN_GPG_PASSPHRASE`, matching the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/), which reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property (default `MAVEN_GPG_PASSPHRASE`).
+The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). It defaults to `GPG_PASSPHRASE`. The [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/) reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property, whose own default is `MAVEN_GPG_PASSPHRASE`.
 
-- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE` (the default), the plugin already reads that variable, so setup-java writes nothing extra to `settings.xml`.
-- If `gpg-passphrase` is any other name, setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable. For example, with `gpg-passphrase: GPG_PASSPHRASE`:
+- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE`, the plugin already reads that variable by default, so setup-java writes nothing extra to `settings.xml`.
+- Otherwise (including the default `GPG_PASSPHRASE`), setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable. For the default `gpg-passphrase: GPG_PASSPHRASE`:
 
 ```xml
     <profiles>
@@ -701,9 +701,9 @@ The `gpg-passphrase` input is the **name of the environment variable** that hold
     </activeProfiles>
 ```
 
-> **Note:** Earlier versions of setup-java wrote a `gpg.passphrase` server to `settings.xml`. That mechanism is deprecated by the Maven GPG Plugin and fails when its `bestPractices` mode is enabled, so setup-java now relies on `gpg.passphraseEnvName` instead.
+> **Note:** Earlier versions of setup-java wrote a `gpg.passphrase` server to `settings.xml`. That mechanism is deprecated by the Maven GPG Plugin and fails when its `bestPractices` mode is enabled, so setup-java now relies on `gpg.passphraseEnvName` instead. The `gpg-passphrase` input and its `GPG_PASSPHRASE` default are unchanged, so existing workflows that set the `GPG_PASSPHRASE` environment variable keep working.
 
-> **Compatibility note:** Reading the passphrase from an environment variable (`gpg.passphraseEnvName`, default `MAVEN_GPG_PASSPHRASE`) requires `maven-gpg-plugin` 3.2.0 or newer. Older versions do not honor this property and will not pick up the passphrase, because setup-java no longer writes the deprecated `gpg.passphrase` server to `settings.xml`. If you are pinned to `maven-gpg-plugin` older than 3.2.0, upgrade to 3.2.0+ (recommended) or supply the passphrase through a mechanism supported by your plugin version.
+> **Compatibility note:** Reading the passphrase from an environment variable (`gpg.passphraseEnvName`) requires `maven-gpg-plugin` 3.2.0 or newer. Older versions do not honor this property and will not pick up the passphrase, because setup-java no longer writes the deprecated `gpg.passphrase` server to `settings.xml`. If you are pinned to `maven-gpg-plugin` older than 3.2.0, upgrade to 3.2.0+.
 
 When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
 

src/constants.ts

@@ -19,7 +19,7 @@ export const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
 export const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
 
 export const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined;
-export const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE';
+export const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
 
 // The default name of the environment variable the maven-gpg-plugin reads the
 // passphrase from (property `gpg.passphraseEnvName`). When the configured