Skip to content

Commit 3563bb3

Browse files
damienbuttdamienbutt
committed
ci: setup GPG signing
1 parent eab6a57 commit 3563bb3

File tree

3 files changed

+78
-122
lines changed

3 files changed

+78
-122
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 52 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -163,51 +163,51 @@ jobs:
163163
retention-days: 30
164164

165165
# Docker build and push
166-
docker:
167-
name: Build Docker Images
168-
runs-on: ubuntu-latest
169-
needs: [test, lint]
170-
if: github.event_name == 'push'
171-
permissions:
172-
contents: read
173-
packages: write
174-
id-token: write
175-
steps:
176-
- name: Checkout code
177-
uses: actions/checkout@v5
178-
179-
- name: Set up Docker Buildx
180-
uses: docker/setup-buildx-action@v3
181-
182-
- name: Log in to GitHub Container Registry
183-
uses: docker/login-action@v3
184-
with:
185-
registry: ghcr.io
186-
username: ${{ github.repository_owner }}
187-
password: ${{ secrets.GITHUB_TOKEN }}
188-
189-
- name: Extract metadata
190-
id: meta
191-
uses: docker/metadata-action@v5
192-
with:
193-
images: ghcr.io/${{ github.repository }}
194-
tags: |
195-
type=ref,event=branch
196-
type=ref,event=pr
197-
type=semver,pattern={{version}}
198-
type=semver,pattern={{major}}.{{minor}}
199-
type=raw,value=latest,enable={{is_default_branch}}
200-
201-
- name: Build and push Docker image
202-
uses: docker/build-push-action@v6
203-
with:
204-
context: .
205-
platforms: linux/amd64,linux/arm64
206-
push: true
207-
tags: ${{ steps.meta.outputs.tags }}
208-
labels: ${{ steps.meta.outputs.labels }}
209-
cache-from: type=gha
210-
cache-to: type=gha,mode=max
166+
# docker:
167+
# name: Build Docker Images
168+
# runs-on: ubuntu-latest
169+
# needs: [test, lint]
170+
# if: github.event_name == 'push'
171+
# permissions:
172+
# contents: read
173+
# packages: write
174+
# id-token: write
175+
# steps:
176+
# - name: Checkout code
177+
# uses: actions/checkout@v5
178+
179+
# - name: Set up Docker Buildx
180+
# uses: docker/setup-buildx-action@v3
181+
182+
# - name: Log in to GitHub Container Registry
183+
# uses: docker/login-action@v3
184+
# with:
185+
# registry: ghcr.io
186+
# username: ${{ github.repository_owner }}
187+
# password: ${{ secrets.GITHUB_TOKEN }}
188+
189+
# - name: Extract metadata
190+
# id: meta
191+
# uses: docker/metadata-action@v5
192+
# with:
193+
# images: ghcr.io/${{ github.repository }}
194+
# tags: |
195+
# type=ref,event=branch
196+
# type=ref,event=pr
197+
# type=semver,pattern={{version}}
198+
# type=semver,pattern={{major}}.{{minor}}
199+
# type=raw,value=latest,enable={{is_default_branch}}
200+
201+
# - name: Build and push Docker image
202+
# uses: docker/build-push-action@v6
203+
# with:
204+
# context: .
205+
# platforms: linux/amd64,linux/arm64
206+
# push: true
207+
# tags: ${{ steps.meta.outputs.tags }}
208+
# labels: ${{ steps.meta.outputs.labels }}
209+
# cache-from: type=gha
210+
# cache-to: type=gha,mode=max
211211

212212
# Validate release prerequisites
213213
validate-release:
@@ -225,17 +225,11 @@ jobs:
225225

226226
- name: Validate prerequisites
227227
env:
228-
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
229-
# HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
230-
SCOOP_BUCKET_GITHUB_TOKEN: ${{ secrets.SCOOP_BUCKET_GITHUB_TOKEN }}
231-
WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
232-
CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
233-
AUR_KEY: ${{ secrets.AUR_KEY }}
228+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
229+
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
230+
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
234231
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
235-
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
236-
GPG_KEY_FILE: ${{ secrets.GPG_KEY_FILE }}
237-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
238-
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
232+
GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
239233
run: ./scripts/validate-release-prerequisites.sh
240234

241235
# GoReleaser configuration and build test
@@ -360,17 +354,10 @@ jobs:
360354
username: ${{ github.actor }}
361355
password: ${{ secrets.GITHUB_TOKEN }}
362356

363-
# - name: Log in to Docker Hub
364-
# uses: docker/login-action@v3
365-
# with:
366-
# username: ${{ secrets.DOCKERHUB_USERNAME }}
367-
# password: ${{ secrets.DOCKERHUB_TOKEN }}
368-
369357
- name: Import GPG key
370358
uses: crazy-max/ghaction-import-gpg@v6
371359
with:
372360
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
373-
passphrase: ${{ secrets.GPG_PASSPHRASE }}
374361

375362
- name: Run GoReleaser
376363
uses: goreleaser/goreleaser-action@v6
@@ -380,51 +367,6 @@ jobs:
380367
args: release --clean
381368
env:
382369
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
383-
HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
384-
SCOOP_BUCKET_GITHUB_TOKEN: ${{ secrets.SCOOP_BUCKET_GITHUB_TOKEN }}
385-
WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
386-
CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
387-
AUR_KEY: ${{ secrets.AUR_KEY }}
388-
GPG_KEY_FILE: ${{ secrets.GPG_KEY_FILE }}
389-
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
390-
391-
# Update package repositories
392-
update-packages:
393-
name: Update Package Repositories
394-
runs-on: ubuntu-latest
395-
needs: [release]
396-
if: startsWith(github.ref, 'refs/tags/v')
397-
steps:
398-
- name: Update Homebrew Formula
399-
run: |
400-
echo "Homebrew formula will be updated automatically by GoReleaser"
401-
402-
- name: Trigger AUR Package Update
403-
run: |
404-
echo "AUR package will be updated automatically by GoReleaser"
405-
406-
- name: Update Winget Manifest
407-
run: |
408-
echo "Winget manifest will be updated automatically by GoReleaser"
409-
410-
# Notify on successful release
411-
notify:
412-
name: Notify Release
413-
runs-on: ubuntu-latest
414-
needs: [release, update-packages]
415-
if: startsWith(github.ref, 'refs/tags/v')
416-
steps:
417-
- name: Get version
418-
id: version
419-
run: echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
420-
421-
- name: Create release announcement
422-
run: |
423-
echo "🚀 Emojify ${{ steps.version.outputs.version }} has been released!"
424-
echo "📦 Available on multiple package managers"
425-
echo "🍺 Homebrew: brew install damienbutt/tap/emojify"
426-
echo "🪟 Scoop: scoop install emojify"
427-
echo "🍫 Chocolatey: choco install emojify"
428-
echo "📦 WinGet: winget install damienbutt.emojify"
429-
echo "🐧 AUR: paru -S emojify-bin"
430-
echo "📸 Snap: sudo snap install emojify"
370+
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
371+
AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
372+
GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}

‎.goreleaser.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,21 @@ archives:
3232
- goos: windows
3333
formats: [zip]
3434

35+
signs:
36+
- artifacts: checksum
37+
args:
38+
[
39+
"--pinentry-mode",
40+
"loopback",
41+
"--batch",
42+
"-u",
43+
"{{ .Env.GPG_FINGERPRINT }}",
44+
"--output",
45+
"${signature}",
46+
"--detach-sign",
47+
"${artifact}",
48+
]
49+
3550
source:
3651
enabled: true
3752

@@ -56,6 +71,12 @@ nfpms:
5671
dst: /usr/share/doc/emojify/LICENSE
5772
- src: ./README.md
5873
dst: /usr/share/doc/emojify/README.md
74+
rpm:
75+
signature:
76+
deb:
77+
signature:
78+
apk:
79+
signature:
5980

6081
release:
6182
github:

‎scripts/validate-release-prerequisites.sh‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -58,19 +58,14 @@ echo "----------------------------------"
5858

5959
# GitHub tokens
6060
check_secret "GITHUB_TOKEN" "true" "GitHub Actions token (auto-provided)"
61-
check_secret "HOMEBREW_TAP_GITHUB_TOKEN" "true" "Token for Homebrew tap repository"
62-
# NOTE: SCOOP_BUCKET_GITHUB_TOKEN not needed when targeting main Scoop repository
61+
check_secret "RELEASE_TOKEN" "true" "Token for Homebrew tap repository"
6362

6463
# GPG signing
6564
check_secret "GPG_PRIVATE_KEY" "true" "GPG private key for package signing"
66-
check_secret "GPG_PASSPHRASE" "true" "GPG key passphrase"
67-
check_secret "GPG_KEY_FILE" "false" "GPG key file for RPM signing"
65+
check_secret "GPG_FINGERPRINT" "true" "GPG key fingerprint for package signing"
6866

6967
# Package manager APIs
70-
check_secret "AUR_KEY" "true" "SSH private key for AUR publishing (both emojify-go and emojify-go-bin)"
71-
72-
# Optional services
73-
check_secret "CODECOV_TOKEN" "false" "Codecov.io token for coverage reporting"
68+
check_secret "AUR_SSH_PRIVATE_KEY" "true" "SSH private key for AUR publishing (both emojify-go and emojify-go-bin)"
7469

7570
echo -e "\n${BLUE}🏗️ Checking Required Repositories${NC}"
7671
echo "--------------------------------------"
@@ -79,11 +74,9 @@ echo "--------------------------------------"
7974
if [ -n "${GITHUB_TOKEN}" ]; then
8075
check_github_repo "damienbutt/homebrew-tap" "Homebrew formula repository"
8176

82-
# Note: Scoop targets main repository, so no custom bucket needed
83-
echo -e "${GREEN}✅ Scoop: Targeting main ScoopInstaller/Main repository${NC}"
77+
check_github_repo "damienbutt/scoop-bucket" "Scoop bucket repository"
8478

85-
# Note: We can't easily check the WinGet fork without more complex logic
86-
echo -e "${YELLOW}ℹ️ Note: Please ensure you have a fork of microsoft/winget-pkgs${NC}"
79+
check_github_repo "damienbutt/winget-pkgs" "Winget package repository"
8780
else
8881
echo -e "${YELLOW}⚠️ Skipping repository checks (no GITHUB_TOKEN)${NC}"
8982
fi

0 commit comments

Comments
 (0)