This Action sets up a GPG and SSH agent. It imports a GPG private key and configures the agent for use with SSH.
| Name | Description | Required |
|---|---|---|
gpg-private-key |
The GPG private key | Yes |
gpg-passphrase |
The passphrase for the GPG private key | Yes |
command |
Shell expression to eval after environment is ready | Yes |
To use this action in your workflow, add the following step:
- name: Set up GPG and SSH Agent
uses: https://git.tatikoma.dev/corpix/gpg-agent-action@master
with:
gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
command: ssh tatikoma.devMake sure to set the GPG_PRIVATE_KEY and GPG_PASSPHRASE secrets in your repository settings.
The action runs a bash script (action.sh) that:
- Creates a custom pinentry script to handle passphrase input.
- Sets up GPG configuration files.
- Starts the GPG agent.
- Imports the provided GPG private key.
- Configures the GPG key for SSH use.
- Evals shell expression in this environment.
This action handles sensitive information. Make sure to:
- Use secrets to store your GPG private key and passphrase.
- Review the action's code to ensure it meets your security requirements.
~ λ gpg --full-generate-key
Please select what kind of key you want:
(1) RSA and RSA
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(9) ECC (sign and encrypt) *default*
(10) ECC (sign only)
(14) Existing key from card
Your selection? 9
Please select which elliptic curve you want:
(1) Curve 25519 *default*
(4) NIST P-384
(6) Brainpool P-256
Your selection? 1
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: Mirror Deploy (automated magic mirror deployments key)
Email address: git@tatikoma.dev
Comment:
You selected this USER-ID:
"Mirror Deploy (automated magic mirror deployments key) <git@tatikoma.dev>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: revocation certificate stored as '/home/user/.gnupg/openpgp-revocs.d/B218324F3A34B2E21FFA329011329B7DAC7BAC39.rev'
public and secret key created and signed.
pub ed25519/0x11329B7DAC7BAC39 2024-10-23 [SC]
B218324F3A34B2E21FFA329011329B7DAC7BAC39
uid Mirror Deploy (automated magic mirror deployments key) <git@tatikoma.dev>
sub cv25519/0x7EC7623B75BE904E 2024-10-23 [E] ~ λ gpg --expert --edit-key 0x11329B7DAC7BAC39
Secret key is available.
sec ed25519/0x11329B7DAC7BAC39
created: 2024-10-23 expires: never usage: SC
trust: ultimate validity: ultimate
ssb cv25519/0x7EC7623B75BE904E
created: 2024-10-23 expires: never usage: E
[ultimate] (1). Mirror Deploy (automated magic mirror deployments key) <git@tatikoma.dev>
gpg> addkey
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
(13) Existing key
(14) Existing key from card
Your selection? 11
Possible actions for this ECC key: Sign Authenticate
Current allowed actions: Sign
(S) Toggle the sign capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? A
Possible actions for this ECC key: Sign Authenticate
Current allowed actions: Sign Authenticate
(S) Toggle the sign capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? A
Possible actions for this ECC key: Sign Authenticate
Current allowed actions: Sign
(S) Toggle the sign capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? A
Possible actions for this ECC key: Sign Authenticate
Current allowed actions: Sign Authenticate
(S) Toggle the sign capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection? Q
Please select which elliptic curve you want:
(1) Curve 25519 *default*
(2) Curve 448
(3) NIST P-256
(4) NIST P-384
(5) NIST P-521
(6) Brainpool P-256
(7) Brainpool P-384
(8) Brainpool P-512
(9) secp256k1
Your selection? 1
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
sec ed25519/0x11329B7DAC7BAC39
created: 2024-10-23 expires: never usage: SC
trust: ultimate validity: ultimate
ssb cv25519/0x7EC7623B75BE904E
created: 2024-10-23 expires: never usage: E
ssb ed25519/0x54BDD809C2BCC1BF
created: 2024-10-23 expires: never usage: SA
[ultimate] (1). Mirror Deploy (automated magic mirror deployments key) <git@tatikoma.dev>
gpg> save ~ λ gpg --armor --export-secret-keys 0x11329B7DAC7BAC39
-----BEGIN PGP PRIVATE KEY BLOCK-----
...
~ λ gpg --export-ssh-key 0x11329B7DAC7BAC39
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP8GmMVaNlFMdxMunLYut3emaff5/5HiYxcRZ8kCfezj openpgp:0xC2BCC1BF