feat: Update recommended configuration for GPG signing#608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brunoborges merged 12 commits into from
Jul 14, 2026
+45 −22
Merged

feat: Update recommended configuration for GPG signing #608

Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
58d36ce
Update recommended configuration for GPG signing
wetneb Mar 13, 2024
e518b2f
Remove unnecessary comment
wetneb Mar 13, 2024
5cf4ad9
Merge branch 'main' into patch-1
brunoborges Jun 22, 2026
695bc16
Potential fix for pull request finding
brunoborges Jun 22, 2026
b975e88
Merge branch 'main' into patch-1
brunoborges Jun 22, 2026
9ccccb7
Merge branch 'main' into patch-1
brunoborges Jun 22, 2026
7d4c734
Merge branch 'main' into patch-1
brunoborges Jun 22, 2026
c5d316e
Merge branch 'main' into patch-1
brunoborges Jun 23, 2026
93b7ba4
Merge branch 'main' into patch-1
brunoborges Jun 23, 2026
e25f707
docs: tidy GPG signing section for bc signer
brunoborges Jul 14, 2026
06b76d5
docs: add legacy GPG signing example alongside bc signer
brunoborges Jul 14, 2026
9640884
Merge remote-tracking branch 'origin/main' into patch-1
brunoborges Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 45 additions & 22 deletions docs/advanced-usage.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -593,14 +593,13 @@ jobs:
server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
server-username: MAVEN_USERNAME # env variable for username in deploy
server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

- name: Publish to Apache Maven Central
run: mvn deploy
run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
env:
MAVEN_USERNAME: maven_username123
MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

Expand All@@ -618,10 +617,6 @@ The two `settings.xml` files created from the above example look like the follow
<username>${env.GITHUB_ACTOR}</username>
<password>${env.GITHUB_TOKEN}</password>
</server>
<server>
<id>gpg.passphrase</id>
<passphrase>${env.GPG_PASSPHRASE}</passphrase>
</server>
</servers>
</settings>
```
Expand All@@ -638,10 +633,6 @@ The two `settings.xml` files created from the above example look like the follow
<username>${env.MAVEN_USERNAME}</username>
<password>${env.MAVEN_CENTRAL_TOKEN}</password>
</server>
<server>
<id>gpg.passphrase</id>
<passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
</server>
</servers>
</settings>
```
Expand All@@ -652,9 +643,48 @@ The two `settings.xml` files created from the above example look like the follow

If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`

### Extra setup for pom.xml:
### GPG

The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.

#### Legacy / alternative: let setup-java import the key

If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

```yaml
- name: Set up Apache Maven Central
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '11'
server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
server-username: MAVEN_USERNAME # env variable for username in deploy
server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

- name: Publish to Apache Maven Central
run: mvn deploy
env:
MAVEN_USERNAME: maven_username123
MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`:

```xml
<server>
<id>gpg.passphrase</id>
<passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
</server>
```

When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:

```xml
<configuration>
Expand All@@ -665,17 +695,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
</gpgArguments>
</configuration>
```
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

### GPG

If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

***NOTE***: Ifthe error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.

## Apache Maven with a settings path

Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat: Update recommended configuration for GPG signing#608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brunoborges
merged 12 commits into

from

Jul 14, 2026

+45

−22

 Merged


feat: Update recommended configuration for GPG signing
#608
 Changes from all commits
Commits

Show all changes


12 commits


Select commit
Hold shift + click to select a range
58d36ce

Update recommended configuration for GPG signing


wetneb Mar 13, 2024
e518b2f

Remove unnecessary comment


wetneb Mar 13, 2024
5cf4ad9

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
695bc16

Potential fix for pull request finding


brunoborges Jun 22, 2026
b975e88

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
9ccccb7

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
7d4c734

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
c5d316e

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
93b7ba4

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
e25f707

docs: tidy GPG signing section for bc signer


brunoborges Jul 14, 2026
06b76d5

docs: add legacy GPG signing example alongside bc signer


brunoborges Jul 14, 2026
9640884

Merge remote-tracking branch 'origin/main' into patch-1


brunoborges Jul 14, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


67 changes: 45 additions & 22 deletions
docs/advanced-usage.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -593,14 +593,13 @@ jobs:
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

Expand All@@ -618,10 +617,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.GITHUB_ACTOR}</username>
 <password>${env.GITHUB_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -638,10 +633,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.MAVEN_USERNAME}</username>
 <password>${env.MAVEN_CENTRAL_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -652,9 +643,48 @@ The two `settings.xml` files created from the above example look like the follow

If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`

### Extra setup for pom.xml:
### GPG

The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.

#### Legacy / alternative: let setup-java import the key

If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

```yaml
 - name: Set up Apache Maven Central
 uses: actions/setup-java@v5
 with:
 distribution: 'temurin'
 java-version: '11'
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`:

```xml
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
```

When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:

```xml
<configuration>
Expand All@@ -665,17 +695,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
 </gpgArguments>
</configuration>
```
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

### GPG

If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

***NOTE***: Ifthe error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.

## Apache Maven with a settings path

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Update recommended configuration for GPG signing#608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brunoborges
merged 12 commits into

from

Jul 14, 2026

+45

−22

 Merged


feat: Update recommended configuration for GPG signing
#608
 Changes from all commits
Commits

Show all changes


12 commits


Select commit
Hold shift + click to select a range
58d36ce

Update recommended configuration for GPG signing


wetneb Mar 13, 2024
e518b2f

Remove unnecessary comment


wetneb Mar 13, 2024
5cf4ad9

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
695bc16

Potential fix for pull request finding


brunoborges Jun 22, 2026
b975e88

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
9ccccb7

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
7d4c734

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
c5d316e

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
93b7ba4

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
e25f707

docs: tidy GPG signing section for bc signer


brunoborges Jul 14, 2026
06b76d5

docs: add legacy GPG signing example alongside bc signer


brunoborges Jul 14, 2026
9640884

Merge remote-tracking branch 'origin/main' into patch-1


brunoborges Jul 14, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


67 changes: 45 additions & 22 deletions
docs/advanced-usage.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -593,14 +593,13 @@ jobs:
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

Expand All@@ -618,10 +617,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.GITHUB_ACTOR}</username>
 <password>${env.GITHUB_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -638,10 +633,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.MAVEN_USERNAME}</username>
 <password>${env.MAVEN_CENTRAL_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -652,9 +643,48 @@ The two `settings.xml` files created from the above example look like the follow

If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`

### Extra setup for pom.xml:
### GPG

The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.

#### Legacy / alternative: let setup-java import the key

If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

```yaml
 - name: Set up Apache Maven Central
 uses: actions/setup-java@v5
 with:
 distribution: 'temurin'
 java-version: '11'
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`:

```xml
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
```

When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:

```xml
<configuration>
Expand All@@ -665,17 +695,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
 </gpgArguments>
</configuration>
```
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

### GPG

If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

***NOTE***: Ifthe error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.

## Apache Maven with a settings path

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Update recommended configuration for GPG signing#608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brunoborges
merged 12 commits into

from

Jul 14, 2026

+45

−22

 Merged


feat: Update recommended configuration for GPG signing
#608
 Changes from all commits
Commits

Show all changes


12 commits


Select commit
Hold shift + click to select a range
58d36ce

Update recommended configuration for GPG signing


wetneb Mar 13, 2024
e518b2f

Remove unnecessary comment


wetneb Mar 13, 2024
5cf4ad9

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
695bc16

Potential fix for pull request finding


brunoborges Jun 22, 2026
b975e88

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
9ccccb7

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
7d4c734

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
c5d316e

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
93b7ba4

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
e25f707

docs: tidy GPG signing section for bc signer


brunoborges Jul 14, 2026
06b76d5

docs: add legacy GPG signing example alongside bc signer


brunoborges Jul 14, 2026
9640884

Merge remote-tracking branch 'origin/main' into patch-1


brunoborges Jul 14, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


67 changes: 45 additions & 22 deletions
docs/advanced-usage.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -593,14 +593,13 @@ jobs:
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

Expand All@@ -618,10 +617,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.GITHUB_ACTOR}</username>
 <password>${env.GITHUB_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -638,10 +633,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.MAVEN_USERNAME}</username>
 <password>${env.MAVEN_CENTRAL_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -652,9 +643,48 @@ The two `settings.xml` files created from the above example look like the follow

If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`

### Extra setup for pom.xml:
### GPG

The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.

#### Legacy / alternative: let setup-java import the key

If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

```yaml
 - name: Set up Apache Maven Central
 uses: actions/setup-java@v5
 with:
 distribution: 'temurin'
 java-version: '11'
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`:

```xml
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
```

When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:

```xml
<configuration>
Expand All@@ -665,17 +695,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
 </gpgArguments>
</configuration>
```
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

### GPG

If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

***NOTE***: Ifthe error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.

## Apache Maven with a settings path

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat: Update recommended configuration for GPG signing#608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brunoborges
merged 12 commits into

from

Jul 14, 2026

+45

−22

 Merged


feat: Update recommended configuration for GPG signing
#608
 Changes from all commits
Commits

Show all changes


12 commits


Select commit
Hold shift + click to select a range
58d36ce

Update recommended configuration for GPG signing


wetneb Mar 13, 2024
e518b2f

Remove unnecessary comment


wetneb Mar 13, 2024
5cf4ad9

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
695bc16

Potential fix for pull request finding


brunoborges Jun 22, 2026
b975e88

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
9ccccb7

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
7d4c734

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
c5d316e

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
93b7ba4

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
e25f707

docs: tidy GPG signing section for bc signer


brunoborges Jul 14, 2026
06b76d5

docs: add legacy GPG signing example alongside bc signer


brunoborges Jul 14, 2026
9640884

Merge remote-tracking branch 'origin/main' into patch-1


brunoborges Jul 14, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


67 changes: 45 additions & 22 deletions
docs/advanced-usage.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -593,14 +593,13 @@ jobs:
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

Expand All@@ -618,10 +617,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.GITHUB_ACTOR}</username>
 <password>${env.GITHUB_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -638,10 +633,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.MAVEN_USERNAME}</username>
 <password>${env.MAVEN_CENTRAL_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -652,9 +643,48 @@ The two `settings.xml` files created from the above example look like the follow

If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`

### Extra setup for pom.xml:
### GPG

The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.

#### Legacy / alternative: let setup-java import the key

If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

```yaml
 - name: Set up Apache Maven Central
 uses: actions/setup-java@v5
 with:
 distribution: 'temurin'
 java-version: '11'
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`:

```xml
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
```

When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:

```xml
<configuration>
Expand All@@ -665,17 +695,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
 </gpgArguments>
</configuration>
```
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

### GPG

If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

***NOTE***: Ifthe error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.

## Apache Maven with a settings path

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Update recommended configuration for GPG signing#608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brunoborges
merged 12 commits into

from

Jul 14, 2026

+45

−22

 Merged


feat: Update recommended configuration for GPG signing
#608
 Changes from all commits
Commits

Show all changes


12 commits


Select commit
Hold shift + click to select a range
58d36ce

Update recommended configuration for GPG signing


wetneb Mar 13, 2024
e518b2f

Remove unnecessary comment


wetneb Mar 13, 2024
5cf4ad9

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
695bc16

Potential fix for pull request finding


brunoborges Jun 22, 2026
b975e88

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
9ccccb7

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
7d4c734

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
c5d316e

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
93b7ba4

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
e25f707

docs: tidy GPG signing section for bc signer


brunoborges Jul 14, 2026
06b76d5

docs: add legacy GPG signing example alongside bc signer


brunoborges Jul 14, 2026
9640884

Merge remote-tracking branch 'origin/main' into patch-1


brunoborges Jul 14, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


67 changes: 45 additions & 22 deletions
docs/advanced-usage.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -593,14 +593,13 @@ jobs:
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

Expand All@@ -618,10 +617,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.GITHUB_ACTOR}</username>
 <password>${env.GITHUB_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -638,10 +633,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.MAVEN_USERNAME}</username>
 <password>${env.MAVEN_CENTRAL_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -652,9 +643,48 @@ The two `settings.xml` files created from the above example look like the follow

If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`

### Extra setup for pom.xml:
### GPG

The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.

#### Legacy / alternative: let setup-java import the key

If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

```yaml
 - name: Set up Apache Maven Central
 uses: actions/setup-java@v5
 with:
 distribution: 'temurin'
 java-version: '11'
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`:

```xml
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
```

When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:

```xml
<configuration>
Expand All@@ -665,17 +695,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
 </gpgArguments>
</configuration>
```
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

### GPG

If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

***NOTE***: Ifthe error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.

## Apache Maven with a settings path

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Update recommended configuration for GPG signing#608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brunoborges
merged 12 commits into

from

Jul 14, 2026

+45

−22

 Merged


feat: Update recommended configuration for GPG signing
#608
 Changes from all commits
Commits

Show all changes


12 commits


Select commit
Hold shift + click to select a range
58d36ce

Update recommended configuration for GPG signing


wetneb Mar 13, 2024
e518b2f

Remove unnecessary comment


wetneb Mar 13, 2024
5cf4ad9

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
695bc16

Potential fix for pull request finding


brunoborges Jun 22, 2026
b975e88

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
9ccccb7

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
7d4c734

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
c5d316e

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
93b7ba4

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
e25f707

docs: tidy GPG signing section for bc signer


brunoborges Jul 14, 2026
06b76d5

docs: add legacy GPG signing example alongside bc signer


brunoborges Jul 14, 2026
9640884

Merge remote-tracking branch 'origin/main' into patch-1


brunoborges Jul 14, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


67 changes: 45 additions & 22 deletions
docs/advanced-usage.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -593,14 +593,13 @@ jobs:
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

Expand All@@ -618,10 +617,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.GITHUB_ACTOR}</username>
 <password>${env.GITHUB_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -638,10 +633,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.MAVEN_USERNAME}</username>
 <password>${env.MAVEN_CENTRAL_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -652,9 +643,48 @@ The two `settings.xml` files created from the above example look like the follow

If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`

### Extra setup for pom.xml:
### GPG

The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.

#### Legacy / alternative: let setup-java import the key

If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

```yaml
 - name: Set up Apache Maven Central
 uses: actions/setup-java@v5
 with:
 distribution: 'temurin'
 java-version: '11'
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`:

```xml
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
```

When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:

```xml
<configuration>
Expand All@@ -665,17 +695,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
 </gpgArguments>
</configuration>
```
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

### GPG

If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

***NOTE***: Ifthe error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.

## Apache Maven with a settings path

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat: Update recommended configuration for GPG signing#608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

brunoborges
merged 12 commits into

from

Jul 14, 2026

+45

−22

 Merged


feat: Update recommended configuration for GPG signing
#608
 Changes from all commits
Commits

Show all changes


12 commits


Select commit
Hold shift + click to select a range
58d36ce

Update recommended configuration for GPG signing


wetneb Mar 13, 2024
e518b2f

Remove unnecessary comment


wetneb Mar 13, 2024
5cf4ad9

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
695bc16

Potential fix for pull request finding


brunoborges Jun 22, 2026
b975e88

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
9ccccb7

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
7d4c734

Merge branch 'main' into patch-1


brunoborges Jun 22, 2026
c5d316e

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
93b7ba4

Merge branch 'main' into patch-1


brunoborges Jun 23, 2026
e25f707

docs: tidy GPG signing section for bc signer


brunoborges Jul 14, 2026
06b76d5

docs: add legacy GPG signing example alongside bc signer


brunoborges Jul 14, 2026
9640884

Merge remote-tracking branch 'origin/main' into patch-1


brunoborges Jul 14, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


67 changes: 45 additions & 22 deletions
docs/advanced-usage.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -593,14 +593,13 @@ jobs:
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

Expand All@@ -618,10 +617,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.GITHUB_ACTOR}</username>
 <password>${env.GITHUB_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -638,10 +633,6 @@ The two `settings.xml` files created from the above example look like the follow
 <username>${env.MAVEN_USERNAME}</username>
 <password>${env.MAVEN_CENTRAL_TOKEN}</password>
 </server>
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
 </servers>
</settings>
```
Expand All@@ -652,9 +643,48 @@ The two `settings.xml` files created from the above example look like the follow

If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`

### Extra setup for pom.xml:
### GPG

The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.

#### Legacy / alternative: let setup-java import the key

If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `gpg` executable, you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

```yaml
 - name: Set up Apache Maven Central
 uses: actions/setup-java@v5
 with:
 distribution: 'temurin'
 java-version: '11'
 server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
 server-username: MAVEN_USERNAME # env variable for username in deploy
 server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
 gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
 gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

 - name: Publish to Apache Maven Central
 run: mvn deploy
 env:
 MAVEN_USERNAME: maven_username123
 MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
 MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
```

The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`:

```xml
 <server>
 <id>gpg.passphrase</id>
 <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
 </server>
```

When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:

```xml
<configuration>
Expand All@@ -665,17 +695,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
 </gpgArguments>
</configuration>
```
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

### GPG

If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).

**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**

See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.

***NOTE***: Ifthe error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.

## Apache Maven with a settings path

Expand Down