René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Support GPG","articleBody":"Releasing artifacts to Maven Central requires publishers to sign all of the assets with GPG. Publishers most commonly deal with this by utilizing [maven-gpg-plugin](https://maven.apache.org/plugins/maven-gpg-plugin/).\r\n\r\nThis is a bit of a headache right now in GitHub actions as you have to create a step in your workflow that:\r\n1. takes a GitHub secret containing your private key and writes it to a file:\r\n  `echo $GPG_PRIVATE_KEY \u003e private.asc`\r\n2. imports the gpg key:\r\n  `gpg --import --batch private.asc`\r\n\r\nAnd to utilize the GPG key, you then have to pass it in as a maven argument:\r\n`-Dgpg.passphrase=$GPG_PASSPHRASE`\r\n\r\nThis is definitely workable (see [link](https://github.com/jaredpetersen/actions-testbed/blob/f23733ce957e28ed0b329a3a6d5f5b96b7720253/.github/workflows/release.yml#L15-L28) for an example workflow) but it's more tedious than needed. It's also not ideal to pass passwords around using the command line even though GitHub Actions sanitizes them. Since setup-java already creates a settings.xml file that is preconfigured to publish to Maven Central, it would be nice if gpg could also be added to the settings.xml file.\r\n\r\nThe usage would look something like the following:\r\n```\r\n- name: Set up Apache Maven Central\r\n  uses: actions/setup-java@v1\r\n  with: # running setup-java again overwrites the settings.xml\r\n     java-version: 1.8\r\n     server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml\r\n     server-username: MAVEN_USERNAME # env variable for username in deploy\r\n     server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy\r\n     gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} # gpg private key to import\r\n     gpg-passphrase: GPG_PASSPHRASE # env variable for gpg signing in deploy\r\n- name: Publish to Apache Maven Central\r\n  run: mvn deploy \r\n  env:\r\n    MAVEN_USERNAME: maven_username123\r\n    MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}\r\n    GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}\r\n```\r\n\r\nAnd the generated settings.xml would look something like:\r\n```xml\r\n\u003cservers\u003e\r\n    \u003cserver\u003e\r\n      \u003cid\u003emaven\u003c/id\u003e\r\n      \u003cusername\u003e${env.MAVEN_USERNAME}\u003c/username\u003e\r\n      \u003cpassword\u003e${env.MAVEN_CENTRAL_TOKEN}\u003c/password\u003e\r\n    \u003c/server\u003e\r\n    \u003cprofiles\u003e\r\n      \u003cprofile\u003e\r\n        \u003cactivation\u003e\r\n          \u003cactiveByDefault\u003etrue\u003c/activeByDefault\u003e\r\n        \u003c/activation\u003e\r\n        \u003cproperties\u003e\r\n          \u003cgpg.passphrase\u003e${env.GPG_PASSPHRASE}\u003c/gpg.passphrase\u003e\r\n        \u003c/properties\u003e\r\n      \u003c/profile\u003e\r\n    \u003cprofiles\u003e\r\n\u003c/servers\u003e\r\n```\r\n\r\nSince gpg is not supported by setup-java, other developers have had to step in to fill the void. [samuelmeuli/action-maven-publish](https://github.com/samuelmeuli/action-maven-publish) was created specifically to fill this gap but it overrides the settings.xml file to do so. It would better if the official setup-java action supported this, especially as some developers/organizations are uncomfortable with third-party actions.\r\n","author":{"url":"https://github.com/jaredpetersen","@type":"Person","name":"jaredpetersen"},"datePublished":"2020-01-18T00:31:39.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":9},"url":"https://github.com/43/setup-java/issues/43"}