.github | ||
__tests__ | ||
dist | ||
node_modules | ||
src | ||
.editorconfig | ||
.gitattributes | ||
.gitignore | ||
.prettierrc.json | ||
action.yml | ||
CHANGELOG.md | ||
jest.config.js | ||
LICENSE | ||
package.json | ||
README.md | ||
tsconfig.json | ||
yarn.lock |
About
GitHub Action to easily import a GPG key.
If you are interested, check out my other :octocat: GitHub Actions!
Features
- Works on Linux, MacOS and Windows virtual environments
- Allow to seed the internal cache of
gpg-agent
with provided passphrase - Purge imported GPG key, cache information and kill agent from runner
- (Git) Enable signing for Git commits, tags and pushes
- (Git) Configure and check committer info against GPG key
Prerequisites
First, export the GPG private key as an ASCII armored version to your clipboard:
# macOS
gpg --armor --export-secret-key joe@foo.bar | pbcopy
# Ubuntu (assuming GNU base64)
gpg --armor --export-secret-key joe@foo.bar -w0 | xclip
# Arch
gpg --armor --export-secret-key joe@foo.bar | sed -z 's;\n;;g' | xclip -selection clipboard -i
# FreeBSD (assuming BSD base64)
gpg --armor --export-secret-key joe@foo.bar | xclip
Paste your clipboard as a secret
named GPG_PRIVATE_KEY
for example. Create another secret with the PASSPHRASE
if applicable.
Usage
Workflow
name: import-gpg
on:
push:
branches: master
jobs:
import-gpg:
runs-on: ubuntu-latest
steps:
-
name: Checkout
uses: actions/checkout@v2
-
name: Import GPG key
id: import_gpg
uses: crazy-max/ghaction-import-gpg@v2
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
PASSPHRASE: ${{ secrets.PASSPHRASE }}
-
name: GPG user IDs
run: |
echo "fingerprint: ${{ steps.import_gpg.outputs.fingerprint }}"
echo "keyid: ${{ steps.import_gpg.outputs.keyid }}"
echo "name: ${{ steps.import_gpg.outputs.name }}"
echo "email: ${{ steps.import_gpg.outputs.email }}"
Sign commits
name: import-gpg
on:
push:
branches: master
jobs:
sign-commit:
runs-on: ubuntu-latest
steps:
-
name: Checkout
uses: actions/checkout@v2
-
name: Import GPG key
uses: crazy-max/ghaction-import-gpg@v2
with:
git_user_signingkey: true
git_commit_gpgsign: true
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
PASSPHRASE: ${{ secrets.PASSPHRASE }}
-
name: Sign commit and push changes
run: |
echo foo > bar.txt
git add .
git commit -S -m "This commit is signed!"
git push
Customizing
inputs
Following inputs can be used as step.with
keys
Name | Type | Description |
---|---|---|
git_user_signingkey |
Bool | Set GPG signing keyID for this Git repository (default false ) |
git_commit_gpgsign ¹ |
Bool | Sign all commits automatically. (default false ) |
git_tag_gpgsign ¹ |
Bool | Sign all tags automatically. (default false ) |
git_push_gpgsign ¹ |
Bool | Sign all pushes automatically. (default false ) |
git_committer_name ¹ |
String | Set commit author's name (defaults to the name associated with the GPG key) |
git_committer_email ¹ |
String | Set commit author's email (defaults to the email address associated with the GPG key) |
¹
git_user_signingkey
needs to be enabled for these inputs to be used.
outputs
Following outputs are available
Name | Type | Description |
---|---|---|
fingerprint |
String | Fingerprint of the GPG key (recommended as user ID) |
keyid |
String | Low 64 bits of the X.509 certificate SHA-1 fingerprint |
name |
String | Name associated with the GPG key |
email |
String | Email address associated with the GPG key |
environment variables
Following environment variables must be used as step.env
keys
Name | Description |
---|---|
GPG_PRIVATE_KEY |
GPG private key exported as an ASCII armored version or its base64 encoding (required) |
PASSPHRASE |
Passphrase of the GPG_PRIVATE_KEY key if setted |
How can I help?
All kinds of contributions are welcome 🙌! The most basic way to show your support is to star 🌟 the project, or to raise issues 💬 You can also support this project by becoming a sponsor on GitHub 👏 or by making a Paypal donation to ensure this journey continues indefinitely! 🚀
Thanks again for your support, it is much appreciated! 🙏
License
MIT. See LICENSE
for more details.