Action to import a GPG key with environment secrets
Find a file
CrazyMax dd220e93c3
Use built-in getExecOutput (#102)
Co-authored-by: CrazyMax <crazy-max@users.noreply.github.com>
2021-08-10 09:00:29 +02:00
.github Handle if-asked for git-push-gpgsign input (#100) 2021-08-10 08:46:50 +02:00
__tests__ Fix setOutput (#86) 2021-05-09 11:15:20 +02:00
dist Use built-in getExecOutput (#102) 2021-08-10 09:00:29 +02:00
hack Enhance workflow (#77) 2021-03-30 20:00:40 +02:00
node_modules Update deps 2020-09-06 21:21:52 +02:00
src Use built-in getExecOutput (#102) 2021-08-10 09:00:29 +02:00
.dockerignore Enhance workflow (#77) 2021-03-30 20:00:40 +02:00
.editorconfig Initial commit 2020-05-03 20:46:05 +02:00
.gitattributes Initial commit 2020-05-03 20:46:05 +02:00
.gitignore Container based developer flow (#76) 2021-01-29 11:29:31 +00:00
.prettierrc.json Codecov 2020-05-06 18:00:13 +02:00
action.yml Handle if-asked for git-push-gpgsign input (#100) 2021-08-10 08:46:50 +02:00
CHANGELOG.md Update CHANGELOG 2021-01-29 12:40:40 +01:00
docker-bake.hcl Enhance workflow (#77) 2021-03-30 20:00:40 +02:00
jest.config.js Use built-in getExecOutput (#102) 2021-08-10 09:00:29 +02:00
LICENSE 2021 2021-01-06 19:05:11 +01:00
package.json Bump @actions/core from 1.2.7 to 1.4.0 (#97) 2021-08-10 08:35:00 +02:00
README.md Handle if-asked for git-push-gpgsign input (#100) 2021-08-10 08:46:50 +02:00
tsconfig.json Codecov 2020-05-06 18:00:13 +02:00
yarn.lock Bump @actions/core from 1.2.7 to 1.4.0 (#97) 2021-08-10 08:35:00 +02:00

GitHub release GitHub marketplace Test workflow Codecov Become a sponsor Paypal Donate

About

GitHub Action to easily import a GPG key.

If you are interested, check out my other :octocat: GitHub Actions!

Import GPG


Features

  • Works on Linux, MacOS and Windows virtual environments
  • Allow to seed the internal cache of gpg-agent with provided passphrase
  • Purge imported GPG key, cache information and kill agent from runner
  • (Git) Enable signing for Git commits, tags and pushes
  • (Git) Configure and check committer info against GPG key

Prerequisites

First, generate a GPG key and export the GPG private key as an ASCII armored version to your clipboard:

# macOS
gpg --armor --export-secret-key joe@foo.bar | pbcopy

# Ubuntu (assuming GNU base64)
gpg --armor --export-secret-key joe@foo.bar -w0 | xclip

# Arch
gpg --armor --export-secret-key joe@foo.bar | xclip -selection clipboard -i

# FreeBSD (assuming BSD base64)
gpg --armor --export-secret-key joe@foo.bar | xclip

Paste your clipboard as a secret named GPG_PRIVATE_KEY for example. Create another secret with the PASSPHRASE if applicable.

Usage

Workflow

name: import-gpg

on:
  push:
    branches: master

jobs:
  import-gpg:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v2
      -
        name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@v3
        with:
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}
      -
        name: GPG user IDs
        run: |
          echo "fingerprint: ${{ steps.import_gpg.outputs.fingerprint }}"
          echo "keyid:       ${{ steps.import_gpg.outputs.keyid }}"
          echo "name:        ${{ steps.import_gpg.outputs.name }}"
          echo "email:       ${{ steps.import_gpg.outputs.email }}"          

Sign commits

name: import-gpg

on:
  push:
    branches: master

jobs:
  sign-commit:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v2
      -
        name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v3
        with:
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}
          git-user-signingkey: true
          git-commit-gpgsign: true
      -
        name: Sign commit and push changes
        run: |
          echo foo > bar.txt
          git add .
          git commit -S -m "This commit is signed!"
          git push          

Customizing

inputs

Following inputs can be used as step.with keys

Name Type Description
gpg-private-key String GPG private key exported as an ASCII armored version or its base64 encoding (required)
passphrase String Passphrase of the GPG private key
git-user-signingkey Bool Set GPG signing keyID for this Git repository (default false)
git-commit-gpgsign¹ Bool Sign all commits automatically. (default false)
git-tag-gpgsign¹ Bool Sign all tags automatically. (default false)
git-push-gpgsign¹ String Sign all pushes automatically. (default if-asked)
git-committer-name¹ String Set commit author's name (defaults to the name associated with the GPG key)
git-committer-email¹ String Set commit author's email (defaults to the email address associated with the GPG key)
workdir String Working directory (below repository root) (default .)

¹ git-user-signingkey needs to be enabled for these inputs to be used.

outputs

Following outputs are available

Name Type Description
fingerprint String Fingerprint of the GPG key (recommended as user ID)
keyid String Low 64 bits of the X.509 certificate SHA-1 fingerprint
name String Name associated with the GPG key
email String Email address associated with the GPG key

Contributing

Want to contribute? Awesome! The most basic way to show your support is to star the project, or to raise issues. If you want to open a pull request, please read the contributing guidelines.

You can also support this project by becoming a sponsor on GitHub or by making a Paypal donation to ensure this journey continues indefinitely!

Thanks again for your support, it is much appreciated! 🙏

License

MIT. See LICENSE for more details.