diff options
| author | Nippy <nippy@Nippy-Mac-mini.local> | 2026-10-17 00:13:39 +0200 |
|---|---|---|
| committer | Nippy <nippy@Nippy-Mac-mini.local> | 2026-10-17 00:13:39 +0200 |
| commit | 69d81738895d86f1659939ad9cd4ccd16ff2a267 (patch) | |
| tree | fbee4ef7a3d617b60cf57b1f79aff6e35e8a7e3f /.forgejo/workflows/build-kernel.yml | |
| parent | 4d6a651315d26604600f10d420d7574c93d8c9f9 (diff) | |
| download | RaveOS-PKGBUILD-69d81738895d86f1659939ad9cd4ccd16ff2a267.tar.gz RaveOS-PKGBUILD-69d81738895d86f1659939ad9cd4ccd16ff2a267.zip | |
Diffstat (limited to '.forgejo/workflows/build-kernel.yml')
| -rw-r--r-- | .forgejo/workflows/build-kernel.yml | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/.forgejo/workflows/build-kernel.yml b/.forgejo/workflows/build-kernel.yml index 3940aa8..5c2b0e5 100644 --- a/.forgejo/workflows/build-kernel.yml +++ b/.forgejo/workflows/build-kernel.yml @@ -44,12 +44,14 @@ jobs: mkdir -p /tmp/builtpkgs - name: Import GPG signing key + env: + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} run: | set -euo pipefail export GNUPGHOME=/tmp/raveos-gnupg rm -rf "$GNUPGHOME" mkdir -m 700 "$GNUPGHOME" - echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import + printf '%s' "$GPG_PRIVATE_KEY" | base64 -d | gpg --batch --import - name: Build linux-raveos run: | @@ -61,12 +63,15 @@ jobs: cp -v *.pkg.tar.zst /tmp/builtpkgs/ - name: Sign built packages + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }} run: | set -euo pipefail export GNUPGHOME=/tmp/raveos-gnupg PASSFILE=$(mktemp) chmod 600 "$PASSFILE" - printf '%s' "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" > "$PASSFILE" + trap 'rm -f "$PASSFILE"' EXIT + printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE" for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do [ -f "$pkg" ] || continue gpg --batch --yes --pinentry-mode loopback \ @@ -77,6 +82,8 @@ jobs: rm -f "$PASSFILE" - name: Update repo database and sync to VPS + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }} run: | set -euo pipefail BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true) @@ -100,7 +107,8 @@ jobs: PASSFILE=$(mktemp) chmod 600 "$PASSFILE" - printf '%s' "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" > "$PASSFILE" + trap 'rm -f "$PASSFILE"' EXIT + printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE" for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do gpg --batch --yes --pinentry-mode loopback \ --passphrase-file "$PASSFILE" \ |