(maven-gh-actions-shared) branch v5 updated: Put Gpg4win before Git Bash's gpg in the Windows build step

[sjaranowski]

This is an automated email from the ASF dual-hosted git repository.

slawekjaranowski pushed a commit to branch v5
in repository https://gitbox.apache.org/repos/asf/maven-gh-actions-shared.git


The following commit(s) were added to refs/heads/v5 by this push:
     new 2d9573a  Put Gpg4win before Git Bash's gpg in the Windows build step
2d9573a is described below

commit 2d9573a618172bcefece10051c62d883d6f95807
Author: Slawomir Jaranowski <s.jaranow...@gmail.com>
AuthorDate: Tue Oct 27 23:22:31 2026 +0100

    Put Gpg4win before Git Bash's gpg in the Windows build step
    
    Since the Build with Maven step runs in Git Bash, its own /usr/bin comes
    first in PATH and Maven runs the MSYS gpg of Git for Windows instead of
    Gpg4win. That gpg reads Windows paths like --homedir D:\... as relative
    ones, so signing fails with "No secret key".
    
    Install GnuPG now exposes the Gpg4win bin directory as a step output,
    which Build with Maven puts first in PATH. Check GnuPG runs in bash with
    the same PATH, so it checks the gpg the build actually uses.
    
    Co-Authored-By: Claude Opus 5.5 <nore...@anthropic.com>
---
 .github/workflows/maven-verify.yml | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/maven-verify.yml 
b/.github/workflows/maven-verify.yml
index f87c1a1..3a1cf64 100644
--- a/.github/workflows/maven-verify.yml
+++ b/.github/workflows/maven-verify.yml
@@ -534,6 +534,7 @@ jobs:
         uses: apache/maven-gh-actions-shared/.github/actions/install-svn@v5
 
       - name: Install GnuPG
+        id: install-gpg
         if: >
           inputs.install-gpg &&
           steps.should-run.conclusion == 'success' &&
@@ -543,15 +544,24 @@ jobs:
           [Environment]::SetEnvironmentVariable("Path", $env:PATH, "Machine")
           choco install --yes gpg4win
           # Gpg4win 4.x (32-bit) deploys GnuPG under "Program Files (x86)", 
5.x+ (64-bit) under "Program Files"
-          "C:\Program Files\GnuPG\bin", "C:\Program Files (x86)\GnuPG\bin" |
+          $bin = "C:\Program Files\GnuPG\bin", "C:\Program Files 
(x86)\GnuPG\bin" |
             Where-Object { Test-Path $_ } |
-            Add-Content $env:GITHUB_PATH
+            Select-Object -First 1
+          Add-Content $env:GITHUB_PATH $bin
+          # Git Bash puts its own /usr/bin first in PATH, so bash steps must 
put Gpg4win before it again
+          Add-Content $env:GITHUB_OUTPUT "bin=$bin"
 
       - name: Check GnuPG
         if: >
           inputs.install-gpg &&
           steps.should-run.conclusion == 'success'
-        run: gpg --version
+        shell: bash
+        env:
+          GPG_BIN: ${{ steps.install-gpg.outputs.bin }}
+        run: |
+          if [ -n "$GPG_BIN" ]; then PATH="$(cygpath --unix 
"$GPG_BIN"):$PATH"; fi
+          command -v gpg
+          gpg --version
 
       - name: Show free disk space
         if: steps.should-run.conclusion == 'success'
@@ -662,7 +672,10 @@ jobs:
           MAVEN_VERSION: ${{ matrix.maven || 
needs.setup-maven-version.outputs.version }}
           ARGS: ${{ inputs.maven-args }}
           GOAL: ${{ inputs.verify-goal }}
+          GPG_BIN: ${{ steps.install-gpg.outputs.bin }}
         run: |
+          # Use Gpg4win rather than the MSYS gpg of Git for Windows, which 
does not understand Windows paths
+          if [ -n "$GPG_BIN" ]; then PATH="$(cygpath --unix 
"$GPG_BIN"):$PATH"; fi
           # Maven 3 has no optional profiles: it reads "?run-its" as a profile 
of that name and leaves run-its off
           if [[ "$MAVEN_VERSION" == 3.* ]]; then 
GOAL="${GOAL//\?run-its/run-its}"; fi
           eval "mvn --errors --batch-mode --show-version $ARGS $GOAL"