probe: verify release secrets #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secrets Probe | |
| on: | |
| push: | |
| branches: | |
| - "probe/**" | |
| permissions: | |
| contents: read | |
| jobs: | |
| probe: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Secret presence | |
| env: | |
| OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }} | |
| OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} | |
| GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} | |
| GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} | |
| run: | | |
| missing="" | |
| [ -z "$OSSRH_USERNAME" ] && missing="$missing OSSRH_USERNAME" | |
| [ -z "$OSSRH_TOKEN" ] && missing="$missing OSSRH_TOKEN" | |
| [ -z "$GPG_PRIVATE_KEY" ] && missing="$missing GPG_PRIVATE_KEY" | |
| [ -z "$GPG_PASSPHRASE" ] && missing="$missing GPG_PASSPHRASE" | |
| if [ -n "$missing" ]; then | |
| echo "::error::missing secrets:$missing" | |
| exit 1 | |
| fi | |
| echo "all 4 secrets present" | |
| - name: GPG key import and sign test | |
| env: | |
| GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} | |
| GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} | |
| run: | | |
| echo "$GPG_PRIVATE_KEY" | gpg --batch --import 2>&1 | tail -2 | |
| fpr=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr/{print $10; exit}') | |
| echo "imported key fingerprint: $fpr" | |
| echo probe > /tmp/probe.txt | |
| gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --clearsign /tmp/probe.txt | |
| echo "GPG sign with passphrase OK" | |
| - name: Central token auth check | |
| env: | |
| MAVEN_CENTRAL_USERNAME: ${{ secrets.OSSRH_USERNAME }} | |
| MAVEN_CENTRAL_TOKEN: ${{ secrets.OSSRH_TOKEN }} | |
| run: | | |
| code=$(curl -sS -o /tmp/central.json -w '%{http_code}' -u "$MAVEN_CENTRAL_USERNAME:$MAVEN_CENTRAL_TOKEN" https://central.sonatype.com/api/v1/user) | |
| echo "central.sonatype.com /api/v1/user -> HTTP $code" | |
| python3 -c "import json;d=json.load(open('/tmp/central.json'));print('account:', d.get('name') or d.get('email') or '?')" 2>/dev/null || true | |
| code2=$(curl -sS -o /dev/null -w '%{http_code}' -u "$MAVEN_CENTRAL_USERNAME:$MAVEN_CENTRAL_TOKEN" https://ossrh-staging-api.central.sonatype.com/service/local/staging/profiles) | |
| echo "ossrh-staging-api /staging/profiles -> HTTP $code2" |