diff --git a/.github/workflows/e2e-cache-dependency-path.yml b/.github/workflows/e2e-cache-dependency-path.yml deleted file mode 100644 index 1c79c081..00000000 --- a/.github/workflows/e2e-cache-dependency-path.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Validate cache with cache-dependency-path option - -on: - push: - branches: - - main - - releases/* - paths-ignore: - - '**.md' - pull_request: - paths-ignore: - - '**.md' - -permissions: - contents: read - -defaults: - run: - shell: bash - -jobs: - gradle1-save: - runs-on: ${{ matrix.os }} - strategy: - fail-fast: false - matrix: - os: [macos-latest, windows-latest, ubuntu-latest] - steps: - - name: Checkout - uses: actions/checkout@v7 - with: - persist-credentials: false - - name: Run setup-java with the cache for gradle - uses: ./ - id: setup-java - with: - distribution: 'adopt' - java-version: '17' - cache: gradle - cache-dependency-path: __tests__/cache/gradle1/*.gradle* - - name: Create files to cache - # Need to avoid using Gradle daemon to stabilize the save process on Windows - # https://github.com/actions/cache/issues/454#issuecomment-840493935 - run: | - gradle downloadDependencies --no-daemon -p __tests__/cache/gradle1 - if [ ! -d ~/.gradle/caches ]; then - echo "::error::The ~/.gradle/caches directory does not exist unexpectedly" - exit 1 - fi - gradle1-restore: - runs-on: ${{ matrix.os }} - strategy: - fail-fast: false - matrix: - os: [macos-latest, windows-latest, ubuntu-latest] - needs: gradle1-save - steps: - - name: Checkout - uses: actions/checkout@v7 - with: - persist-credentials: false - - name: Run setup-java with the cache for gradle - uses: ./ - id: setup-java - with: - distribution: 'adopt' - java-version: '11' - cache: gradle - cache-dependency-path: __tests__/cache/gradle1/*.gradle* - - name: Confirm that ~/.gradle/caches directory has been made - run: | - if [ ! -d ~/.gradle/caches ]; then - echo "::error::The ~/.gradle/caches directory does not exist unexpectedly" - exit 1 - fi - ls ~/.gradle/caches/ - gradle2-restore: - runs-on: ${{ matrix.os }} - strategy: - fail-fast: false - matrix: - os: [macos-latest, windows-latest, ubuntu-latest] - needs: gradle1-save - steps: - - name: Checkout - uses: actions/checkout@v7 - with: - persist-credentials: false - - name: Run setup-java with the cache for gradle - uses: ./ - id: setup-java - with: - distribution: 'adopt' - java-version: '11' - cache: gradle - cache-dependency-path: __tests__/cache/gradle2/*.gradle* - - name: Confirm that ~/.gradle/caches directory has not been made - run: | - if [ -d ~/.gradle/caches ]; then - echo "::error::The ~/.gradle/caches directory exists unexpectedly" - exit 1 - fi diff --git a/.github/workflows/e2e-cache.yml b/.github/workflows/e2e-cache.yml index c76cf50b..07a1c644 100644 --- a/.github/workflows/e2e-cache.yml +++ b/.github/workflows/e2e-cache.yml @@ -42,10 +42,7 @@ jobs: # https://github.com/actions/cache/issues/454#issuecomment-840493935 run: | gradle downloadDependencies --no-daemon -p __tests__/cache/gradle1 - if [ ! -d ~/.gradle/caches ]; then - echo "::error::The ~/.gradle/caches directory does not exist unexpectedly" - exit 1 - fi + bash __tests__/check-dir.sh "$HOME/.gradle/caches" gradle-restore: runs-on: ${{ matrix.os }} strategy: @@ -66,12 +63,7 @@ jobs: java-version: '11' cache: gradle - name: Confirm that ~/.gradle/caches directory has been made - run: | - if [ ! -d ~/.gradle/caches ]; then - echo "::error::The ~/.gradle/caches directory does not exist unexpectedly" - exit 1 - fi - ls ~/.gradle/caches/ + run: bash __tests__/check-dir.sh "$HOME/.gradle/caches" maven-save: runs-on: ${{ matrix.os }} strategy: @@ -93,10 +85,7 @@ jobs: - name: Create files to cache run: | mvn verify -f __tests__/cache/maven/pom.xml - if [ ! -d ~/.m2/repository ]; then - echo "::error::The ~/.m2/repository directory does not exist unexpectedly" - exit 1 - fi + bash __tests__/check-dir.sh "$HOME/.m2/repository" maven-restore: runs-on: ${{ matrix.os }} strategy: @@ -117,12 +106,7 @@ jobs: java-version: '11' cache: maven - name: Confirm that ~/.m2/repository directory has been made - run: | - if [ ! -d ~/.m2/repository ]; then - echo "::error::The ~/.m2/repository directory does not exist unexpectedly" - exit 1 - fi - ls ~/.m2/repository + run: bash __tests__/check-dir.sh "$HOME/.m2/repository" sbt-save: runs-on: ${{ matrix.os }} defaults: @@ -155,25 +139,13 @@ jobs: - name: Check files to cache on macos-latest if: matrix.os == 'macos-15-intel' - run: | - if [ ! -d ~/Library/Caches/Coursier ]; then - echo "::error::The ~/Library/Caches/Coursier directory does not exist unexpectedly" - exit 1 - fi + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier" - name: Check files to cache on windows-latest if: matrix.os == 'windows-latest' - run: | - if [ ! -d ~/AppData/Local/Coursier/Cache ]; then - echo "::error::The ~/AppData/Local/Coursier/Cache directory does not exist unexpectedly" - exit 1 - fi + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache" - name: Check files to cache on ubuntu-latest - if: matrix.os == 'ubuntu-latest' - run: | - if [ ! -d ~/.cache/coursier ]; then - echo "::error::The ~/.cache/coursier directory does not exist unexpectedly" - exit 1 - fi + if: matrix.os == 'ubuntu-22.04' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier" sbt-restore: runs-on: ${{ matrix.os }} defaults: @@ -200,25 +172,254 @@ jobs: - name: Confirm that ~/Library/Caches/Coursier directory has been made if: matrix.os == 'macos-15-intel' - run: | - if [ ! -d ~/Library/Caches/Coursier ]; then - echo "::error::The ~/Library/Caches/Coursier directory does not exist unexpectedly" - exit 1 - fi - ls ~/Library/Caches/Coursier + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier" - name: Confirm that ~/AppData/Local/Coursier/Cache directory has been made if: matrix.os == 'windows-latest' - run: | - if [ ! -d ~/AppData/Local/Coursier/Cache ]; then - echo "::error::The ~/AppData/Local/Coursier/Cache directory does not exist unexpectedly" - exit 1 - fi - ls ~/AppData/Local/Coursier/Cache + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache" - name: Confirm that ~/.cache/coursier directory has been made - if: matrix.os == 'ubuntu-latest' + if: matrix.os == 'ubuntu-22.04' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier" + gradle1-save: + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [macos-latest, windows-latest, ubuntu-latest] + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for gradle + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '17' + cache: gradle + cache-dependency-path: __tests__/cache/gradle1/*.gradle* + - name: Create files to cache + # Need to avoid using Gradle daemon to stabilize the save process on Windows + # https://github.com/actions/cache/issues/454#issuecomment-840493935 run: | - if [ ! -d ~/.cache/coursier ]; then - echo "::error::The ~/.cache/coursier directory does not exist unexpectedly" - exit 1 - fi - ls ~/.cache/coursier + gradle downloadDependencies --no-daemon -p __tests__/cache/gradle1 + bash __tests__/check-dir.sh "$HOME/.gradle/caches" + gradle1-restore: + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [macos-latest, windows-latest, ubuntu-latest] + needs: gradle1-save + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for gradle + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '11' + cache: gradle + cache-dependency-path: __tests__/cache/gradle1/*.gradle* + - name: Confirm that ~/.gradle/caches directory has been made + run: bash __tests__/check-dir.sh "$HOME/.gradle/caches" + gradle2-restore: + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [macos-latest, windows-latest, ubuntu-latest] + needs: gradle1-save + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for gradle + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '11' + cache: gradle + cache-dependency-path: __tests__/cache/gradle2/*.gradle* + - name: Confirm that ~/.gradle/caches directory has not been made + run: bash __tests__/check-dir.sh "$HOME/.gradle/caches" absent + maven1-save: + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [macos-15-intel, windows-latest, ubuntu-latest] + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for maven + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '11' + cache: maven + cache-dependency-path: __tests__/cache/maven/pom.xml + - name: Create files to cache + run: | + mvn verify -f __tests__/cache/maven/pom.xml + bash __tests__/check-dir.sh "$HOME/.m2/repository" + maven1-restore: + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [macos-15-intel, windows-latest, ubuntu-latest] + needs: maven1-save + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for maven + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '11' + cache: maven + cache-dependency-path: __tests__/cache/maven/pom.xml + - name: Confirm that ~/.m2/repository directory has been made + run: bash __tests__/check-dir.sh "$HOME/.m2/repository" + maven2-restore: + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [macos-15-intel, windows-latest, ubuntu-latest] + needs: maven1-save + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for maven + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '11' + cache: maven + cache-dependency-path: __tests__/cache/maven2/pom.xml + - name: Confirm that ~/.m2/repository directory has not been made + run: bash __tests__/check-dir.sh "$HOME/.m2/repository" absent + sbt1-save: + runs-on: ${{ matrix.os }} + defaults: + run: + shell: bash + working-directory: __tests__/cache/sbt + strategy: + fail-fast: false + matrix: + os: [macos-15-intel, windows-latest, ubuntu-22.04] + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for sbt + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '11' + cache: sbt + cache-dependency-path: __tests__/cache/sbt/*.sbt + - name: Setup SBT + if: matrix.os == 'macos-15-intel' + run: | + echo ""Installing SBT..."" + brew install sbt + - name: Create files to cache + run: sbt update + + - name: Check files to cache on macos-latest + if: matrix.os == 'macos-15-intel' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier" + - name: Check files to cache on windows-latest + if: matrix.os == 'windows-latest' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache" + - name: Check files to cache on ubuntu-latest + if: matrix.os == 'ubuntu-22.04' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier" + sbt1-restore: + runs-on: ${{ matrix.os }} + defaults: + run: + shell: bash + working-directory: __tests__/cache/sbt + strategy: + fail-fast: false + matrix: + os: [macos-15-intel, windows-latest, ubuntu-22.04] + needs: sbt1-save + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for sbt + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '11' + cache: sbt + cache-dependency-path: __tests__/cache/sbt/*.sbt + + - name: Confirm that ~/Library/Caches/Coursier directory has been made + if: matrix.os == 'macos-15-intel' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier" + - name: Confirm that ~/AppData/Local/Coursier/Cache directory has been made + if: matrix.os == 'windows-latest' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache" + - name: Confirm that ~/.cache/coursier directory has been made + if: matrix.os == 'ubuntu-22.04' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier" + sbt2-restore: + runs-on: ${{ matrix.os }} + defaults: + run: + shell: bash + working-directory: __tests__/cache/sbt2 + strategy: + fail-fast: false + matrix: + os: [macos-15-intel, windows-latest, ubuntu-22.04] + needs: sbt1-save + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run setup-java with the cache for sbt + uses: ./ + id: setup-java + with: + distribution: 'adopt' + java-version: '11' + cache: sbt + cache-dependency-path: __tests__/cache/sbt2/*.sbt + + - name: Confirm that ~/Library/Caches/Coursier directory has not been made + if: matrix.os == 'macos-15-intel' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier" absent + - name: Confirm that ~/AppData/Local/Coursier/Cache directory has not been made + if: matrix.os == 'windows-latest' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache" absent + - name: Confirm that ~/.cache/coursier directory has not been made + if: matrix.os == 'ubuntu-22.04' + run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier" absent diff --git a/.github/workflows/e2e-publishing.yml b/.github/workflows/e2e-publishing.yml index 02a6b259..87316059 100644 --- a/.github/workflows/e2e-publishing.yml +++ b/.github/workflows/e2e-publishing.yml @@ -46,13 +46,25 @@ jobs: $xmlPath = Join-Path $HOME ".m2" "settings.xml" Get-Content $xmlPath | ForEach-Object { Write-Host $_ } - [xml]$xml = Get-Content $xmlPath - $servers = $xml.settings.servers.server - if (($servers[0].id -ne 'maven') -or ($servers[0].username -ne '${env.MAVEN_USERNAME}') -or ($servers[0].password -ne '${env.MAVEN_CENTRAL_TOKEN}')) { - throw "Generated XML file is incorrect" - } + $content = [System.IO.File]::ReadAllText($xmlPath) + $expected = @( + '' + ' false' + ' ' + ' ' + ' maven' + ' ${env.MAVEN_USERNAME}' + ' ${env.MAVEN_CENTRAL_TOKEN}' + ' ' + ' ' + '' + ) -join "`n" - if (($servers[1].id -ne 'gpg.passphrase') -or ($servers[1].passphrase -ne '${env.MAVEN_GPG_PASSPHRASE}')) { + if ($content -ne $expected) { + Write-Host "Expected settings.xml:" + $expected -split "`n" | ForEach-Object { Write-Host $_ } throw "Generated XML file is incorrect" } diff --git a/README.md b/README.md index 199c53d5..8310fe7d 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,12 @@ This action allows you to work with Java and Scala projects. - **Migrated to ESM** to enable support for the latest `@actions/*` package versions. This is an internal implementation change only. No changes are required to your workflow configuration, and the action's behavior is unchanged. Existing workflows continue to work as before. +## Breaking changes in V6 + +- **The GPG passphrase is now passed to the Maven GPG Plugin through an environment variable (`gpg.passphraseEnvName`) instead of the deprecated `gpg.passphrase` server in `settings.xml`.** The `gpg-passphrase` input and its default (`GPG_PASSPHRASE`) are unchanged, so if you already set that environment variable in your build step your workflow keeps working. However, this now requires `maven-gpg-plugin` **3.2.0 or newer**; older versions do not honor `gpg.passphraseEnvName` and, because the `gpg.passphrase` server is no longer written, will not pick up the passphrase. Upgrade the plugin to 3.2.0+. + + See [GPG](docs/advanced-usage.md#gpg) for details. + ## Breaking changes in V5 - Upgraded action from node20 to node24 diff --git a/__tests__/auth.test.ts b/__tests__/auth.test.ts index 7ed67561..0c0da081 100644 --- a/__tests__/auth.test.ts +++ b/__tests__/auth.test.ts @@ -228,9 +228,40 @@ describe('auth tests', () => { \${env.${username}} \${env.&<>"''"><&} + + + + setup-java-gpg + + ${gpgPassphrase} + + + + + setup-java-gpg + +`; + + expect(auth.generate(id, username, password, gpgPassphrase)).toEqual( + expectedSettings + ); + }); + + it('does not add a gpg profile when the passphrase env var is the maven-gpg-plugin default', () => { + const id = 'packages'; + const username = 'USER'; + const password = '&<>"\'\'"><&'; + const gpgPassphrase = 'MAVEN_GPG_PASSPHRASE'; + + const expectedSettings = ` + false + - gpg.passphrase - \${env.${gpgPassphrase}} + ${id} + \${env.${username}} + \${env.&<>"''"><&} `; diff --git a/__tests__/cache/maven2/.gitignore b/__tests__/cache/maven2/.gitignore new file mode 100644 index 00000000..0e13eebb --- /dev/null +++ b/__tests__/cache/maven2/.gitignore @@ -0,0 +1,11 @@ +target/ +pom.xml.tag +pom.xml.releaseBackup +pom.xml.versionsBackup +pom.xml.next +release.properties +dependency-reduced-pom.xml +buildNumber.properties +.mvn/timing.properties +# https://github.com/takari/maven-wrapper#usage-without-binary-jar +.mvn/wrapper/maven-wrapper.jar diff --git a/__tests__/cache/maven2/pom.xml b/__tests__/cache/maven2/pom.xml new file mode 100644 index 00000000..70b8d0cc --- /dev/null +++ b/__tests__/cache/maven2/pom.xml @@ -0,0 +1,15 @@ + + + 4.0.0 + io.github.actions + setup-java-maven2-example + 1.0.0-SNAPSHOT + jar + + + org.apache.commons + commons-lang3 + 3.12.0 + + + diff --git a/__tests__/cache/sbt2/.gitignore b/__tests__/cache/sbt2/.gitignore new file mode 100644 index 00000000..2f7896d1 --- /dev/null +++ b/__tests__/cache/sbt2/.gitignore @@ -0,0 +1 @@ +target/ diff --git a/__tests__/cache/sbt2/build.sbt b/__tests__/cache/sbt2/build.sbt new file mode 100644 index 00000000..c8737676 --- /dev/null +++ b/__tests__/cache/sbt2/build.sbt @@ -0,0 +1,3 @@ +ThisBuild / scalaVersion := "2.12.15" + +libraryDependencies += "org.scala-lang.modules" %% "scala-parser-combinators" % "2.1.1" diff --git a/__tests__/check-dir.sh b/__tests__/check-dir.sh new file mode 100755 index 00000000..30da05fd --- /dev/null +++ b/__tests__/check-dir.sh @@ -0,0 +1,39 @@ +#!/bin/sh +# Assert whether a directory exists, for use in the e2e cache workflows. +# +# Usage: check-dir.sh [present|absent] +# +# present (default): fail if does NOT exist, otherwise list its contents. +# absent: fail if DOES exist. +# +# Call with already-expanded paths (e.g. "$HOME/.gradle/caches") to avoid +# tilde-expansion pitfalls. +set -eu + +if [ "$#" -lt 1 ]; then + echo "Usage: check-dir.sh [present|absent]" >&2 + exit 2 +fi + +dir=$1 +mode=${2:-present} + +case "$mode" in + present) + if [ ! -d "$dir" ]; then + echo "::error::The $dir directory does not exist unexpectedly" + exit 1 + fi + ls "$dir" + ;; + absent) + if [ -d "$dir" ]; then + echo "::error::The $dir directory exists unexpectedly" + exit 1 + fi + ;; + *) + echo "::error::Unknown mode '$mode' (expected 'present' or 'absent')" + exit 1 + ;; +esac diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index e710603c..40b7bac3 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -95849,6 +95849,12 @@ const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key'; const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; const INPUT_DEFAULT_GPG_PRIVATE_KEY = (/* unused pure expression or super */ null && (undefined)); const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +// The default name of the environment variable the maven-gpg-plugin reads the +// passphrase from (property `gpg.passphraseEnvName`). When the configured +// passphrase env var name matches this, no extra configuration is required. +const MAVEN_GPG_PASSPHRASE_DEFAULT_ENV = 'MAVEN_GPG_PASSPHRASE'; +// Id of the settings.xml profile used to set `gpg.passphraseEnvName`. +const GPG_PASSPHRASE_PROFILE_ID = 'setup-java-gpg'; const INPUT_CACHE = 'cache'; const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path'; const INPUT_JOB_STATUS = 'job-status'; diff --git a/dist/setup/index.js b/dist/setup/index.js index f3456691..ee21689e 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -73294,6 +73294,12 @@ const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key'; const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined; const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +// The default name of the environment variable the maven-gpg-plugin reads the +// passphrase from (property `gpg.passphraseEnvName`). When the configured +// passphrase env var name matches this, no extra configuration is required. +const MAVEN_GPG_PASSPHRASE_DEFAULT_ENV = 'MAVEN_GPG_PASSPHRASE'; +// Id of the settings.xml profile used to set `gpg.passphraseEnvName`. +const GPG_PASSPHRASE_PROFILE_ID = 'setup-java-gpg'; const INPUT_CACHE = 'cache'; const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path'; const constants_INPUT_JOB_STATUS = 'job-status'; @@ -127311,12 +127317,25 @@ function generate(id, username, password, gpgPassphrase) { } } }; - if (gpgPassphrase) { - const gpgServer = { - id: 'gpg.passphrase', - passphrase: `\${env.${gpgPassphrase}}` + // The maven-gpg-plugin reads the passphrase from the environment variable + // named by the `gpg.passphraseEnvName` property (default MAVEN_GPG_PASSPHRASE). + // Only configure it when the requested env var name differs from that default; + // otherwise the plugin already reads the right variable and no extra settings + // are needed. Writing `gpg.passphrase` to settings.xml is deprecated and fails + // when the plugin's `bestPractices` mode is enabled. + if (gpgPassphrase && + gpgPassphrase !== MAVEN_GPG_PASSPHRASE_DEFAULT_ENV) { + xmlObj.settings.profiles = { + profile: { + id: GPG_PASSPHRASE_PROFILE_ID, + properties: { + 'gpg.passphraseEnvName': gpgPassphrase + } + } + }; + xmlObj.settings.activeProfiles = { + activeProfile: GPG_PASSPHRASE_PROFILE_ID }; - xmlObj.settings.servers.server.push(gpgServer); } return (0,lib/* create */.vt)(xmlObj).end({ headless: true, diff --git a/docs/advanced-usage.md b/docs/advanced-usage.md index 28c6d192..762b3126 100644 --- a/docs/advanced-usage.md +++ b/docs/advanced-usage.md @@ -660,7 +660,9 @@ See the help docs on [Publishing a Package](https://help.github.com/en/github/ma #### Legacy / alternative: let setup-java import the key -If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances). +If you prefer signing with the `gpg` executable (for example because you are using `maven-gpg-plugin` older than 3.2.0), you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances). + +setup-java imports the key independently of the plugin version, but the generated passphrase profile described below uses `gpg.passphraseEnvName`, which requires `maven-gpg-plugin` 3.2.0 or newer. Since `gpg-passphrase` defaults to `GPG_PASSPHRASE`, setup-java writes that profile unless you override the input to `MAVEN_GPG_PASSPHRASE`. ```yaml - name: Set up Apache Maven Central @@ -682,15 +684,29 @@ If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the ` MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} ``` -With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`: +The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). It defaults to `GPG_PASSPHRASE`. The [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/) reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property, whose own default is `MAVEN_GPG_PASSPHRASE`. + +- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE`, the plugin already reads that variable by default, so setup-java writes nothing extra to `settings.xml`. +- Otherwise (including the default `GPG_PASSPHRASE`), setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable. For the default `gpg-passphrase: GPG_PASSPHRASE`: ```xml - - gpg.passphrase - ${env.MAVEN_GPG_PASSPHRASE} - + + + setup-java-gpg + + GPG_PASSPHRASE + + + + + setup-java-gpg + ``` +> **Note:** Earlier versions of setup-java wrote a `gpg.passphrase` server to `settings.xml`. That mechanism is deprecated by the Maven GPG Plugin and fails when its `bestPractices` mode is enabled, so setup-java now relies on `gpg.passphraseEnvName` instead. The `gpg-passphrase` input and its `GPG_PASSPHRASE` default are unchanged, so existing workflows that set the `GPG_PASSPHRASE` environment variable keep working. + +> **Compatibility note:** Reading the passphrase from an environment variable (`gpg.passphraseEnvName`) requires `maven-gpg-plugin` 3.2.0 or newer. Older versions do not honor this property and will not pick up the passphrase, because setup-java no longer writes the deprecated `gpg.passphrase` server to `settings.xml`. If you are pinned to `maven-gpg-plugin` older than 3.2.0, upgrade to 3.2.0+. + When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`: ```xml @@ -703,7 +719,7 @@ When signing with the `gpg` executable, the Maven GPG Plugin configuration in yo ``` -GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`. +GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to read the passphrase non-interactively. ***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher. diff --git a/src/auth.ts b/src/auth.ts index 2f0ac608..4d9dde82 100644 --- a/src/auth.ts +++ b/src/auth.ts @@ -93,12 +93,27 @@ export function generate( } }; - if (gpgPassphrase) { - const gpgServer = { - id: 'gpg.passphrase', - passphrase: `\${env.${gpgPassphrase}}` + // The maven-gpg-plugin reads the passphrase from the environment variable + // named by the `gpg.passphraseEnvName` property (default MAVEN_GPG_PASSPHRASE). + // Only configure it when the requested env var name differs from that default; + // otherwise the plugin already reads the right variable and no extra settings + // are needed. Writing `gpg.passphrase` to settings.xml is deprecated and fails + // when the plugin's `bestPractices` mode is enabled. + if ( + gpgPassphrase && + gpgPassphrase !== constants.MAVEN_GPG_PASSPHRASE_DEFAULT_ENV + ) { + xmlObj.settings.profiles = { + profile: { + id: constants.GPG_PASSPHRASE_PROFILE_ID, + properties: { + 'gpg.passphraseEnvName': gpgPassphrase + } + } + }; + xmlObj.settings.activeProfiles = { + activeProfile: constants.GPG_PASSPHRASE_PROFILE_ID }; - xmlObj.settings.servers.server.push(gpgServer); } return xmlCreate(xmlObj).end({ diff --git a/src/constants.ts b/src/constants.ts index 2f7362b0..d3ac9c59 100644 --- a/src/constants.ts +++ b/src/constants.ts @@ -21,6 +21,14 @@ export const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; export const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined; export const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +// The default name of the environment variable the maven-gpg-plugin reads the +// passphrase from (property `gpg.passphraseEnvName`). When the configured +// passphrase env var name matches this, no extra configuration is required. +export const MAVEN_GPG_PASSPHRASE_DEFAULT_ENV = 'MAVEN_GPG_PASSPHRASE'; + +// Id of the settings.xml profile used to set `gpg.passphraseEnvName`. +export const GPG_PASSPHRASE_PROFILE_ID = 'setup-java-gpg'; + export const INPUT_CACHE = 'cache'; export const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path'; export const INPUT_JOB_STATUS = 'job-status';