From 4dbb381e91d9a7627fc62e9a568c422c8b438bdb Mon Sep 17 00:00:00 2001 From: Bruno Borges Date: Tue, 14 Jul 2026 22:18:37 -0400 Subject: [PATCH] Default gpg-passphrase to MAVEN_GPG_PASSPHRASE Align the default `gpg-passphrase` input value with the maven-gpg-plugin default environment variable name (MAVEN_GPG_PASSPHRASE). With this default, setup-java writes no extra GPG configuration to settings.xml and the plugin reads the passphrase from MAVEN_GPG_PASSPHRASE out of the box. Also document that reading the passphrase from an environment variable via `gpg.passphraseEnvName` requires maven-gpg-plugin 3.2.0 or newer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 --- README.md | 2 +- action.yml | 2 +- dist/cleanup/index.js | 2 +- dist/setup/index.js | 2 +- docs/advanced-usage.md | 8 +++++--- src/constants.ts | 2 +- 6 files changed, 10 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 199c53d5..607f3733 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,7 @@ For more details, see the full release notes on the [releases page](https://git - `gpg-private-key`: GPG private key to import. Default is empty string. - - `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is GPG_PASSPHRASE. + - `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is MAVEN_GPG_PASSPHRASE. - `mvn-toolchain-id`: Name of Maven Toolchain ID if the default name of `${distribution}_${java-version}` is not wanted. diff --git a/action.yml b/action.yml index f7027a83..611c98f8 100644 --- a/action.yml +++ b/action.yml @@ -68,7 +68,7 @@ inputs: required: false default: '' gpg-passphrase: - description: 'Environment variable name for the GPG private key passphrase. Defaults to GPG_PASSPHRASE when gpg-private-key is set; ignored otherwise.' + description: 'Environment variable name for the GPG private key passphrase. Defaults to MAVEN_GPG_PASSPHRASE when gpg-private-key is set; ignored otherwise.' required: false cache: description: 'Name of the build platform to cache dependencies. It can be "maven", "gradle" or "sbt".' diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index 40b7bac3..1bfe5e3d 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -95848,7 +95848,7 @@ const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings'; const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key'; const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; const INPUT_DEFAULT_GPG_PRIVATE_KEY = (/* unused pure expression or super */ null && (undefined)); -const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE'; // The default name of the environment variable the maven-gpg-plugin reads the // passphrase from (property `gpg.passphraseEnvName`). When the configured // passphrase env var name matches this, no extra configuration is required. diff --git a/dist/setup/index.js b/dist/setup/index.js index ee21689e..192f5f4c 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -73293,7 +73293,7 @@ const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings'; const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key'; const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined; -const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE'; // The default name of the environment variable the maven-gpg-plugin reads the // passphrase from (property `gpg.passphraseEnvName`). When the configured // passphrase env var name matches this, no extra configuration is required. diff --git a/docs/advanced-usage.md b/docs/advanced-usage.md index 8a112afc..4fa5c55b 100644 --- a/docs/advanced-usage.md +++ b/docs/advanced-usage.md @@ -682,10 +682,10 @@ If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the ` MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} ``` -The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). The [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/) reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property, which defaults to `MAVEN_GPG_PASSPHRASE`. +The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). It defaults to `MAVEN_GPG_PASSPHRASE`, matching the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/), which reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property (default `MAVEN_GPG_PASSPHRASE`). -- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE`, the plugin already reads that variable by default, so setup-java writes nothing extra to `settings.xml`. -- If `gpg-passphrase` is any other name, setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable: +- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE` (the default), the plugin already reads that variable, so setup-java writes nothing extra to `settings.xml`. +- If `gpg-passphrase` is any other name, setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable. For example, with `gpg-passphrase: GPG_PASSPHRASE`: ```xml @@ -703,6 +703,8 @@ The `gpg-passphrase` input is the **name of the environment variable** that hold > **Note:** Earlier versions of setup-java wrote a `gpg.passphrase` server to `settings.xml`. That mechanism is deprecated by the Maven GPG Plugin and fails when its `bestPractices` mode is enabled, so setup-java now relies on `gpg.passphraseEnvName` instead. +> **Compatibility note:** Reading the passphrase from an environment variable (`gpg.passphraseEnvName`, default `MAVEN_GPG_PASSPHRASE`) requires `maven-gpg-plugin` 3.2.0 or newer. Older versions do not honor this property and will not pick up the passphrase, because setup-java no longer writes the deprecated `gpg.passphrase` server to `settings.xml`. If you are pinned to `maven-gpg-plugin` older than 3.2.0, upgrade to 3.2.0+ (recommended) or supply the passphrase through a mechanism supported by your plugin version. + When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`: ```xml diff --git a/src/constants.ts b/src/constants.ts index d3ac9c59..4a7879c4 100644 --- a/src/constants.ts +++ b/src/constants.ts @@ -19,7 +19,7 @@ export const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key'; export const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; export const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined; -export const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +export const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE'; // The default name of the environment variable the maven-gpg-plugin reads the // passphrase from (property `gpg.passphraseEnvName`). When the configured