From 4da176d507c7ddef782a69412688cc795c858c0f Mon Sep 17 00:00:00 2001 From: Rootiest Date: Wed, 9 Sep 2026 23:52:40 -0400 Subject: [PATCH] fix(ci): base64-encode the bot GPG key secret Raw multi-line armored key piped through 'echo | gpg --import' came out CRC-corrupted (Invalid keyring) on the first real run -- something in the secret/env round-trip mangles embedded newlines. Regenerated the bot key (old one is unrecoverable, secrets are write-only) and store it base64-encoded, decoded with base64 -d before import. --- .github/workflows/ci.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e3bdeb4..7a86296 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -135,15 +135,21 @@ jobs: # of server config. fishconfig-bot is a dedicated Gitea account # (verified email, no login) that owns this key; the private # key lives only in the CI_GPG_PRIVATE_KEY repo secret. + # + # Secret is base64-encoded: a raw multi-line armored key piped + # through `echo "$VAR" | gpg --import` came out CRC-corrupted + # ("Invalid keyring") the first time this ran -- something in + # the secret/env round-trip mangles embedded newlines. Base64 + # collapses it to one line immune to that. export GNUPGHOME="$(mktemp -d)" chmod 700 "$GNUPGHOME" echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf" echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf" command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg - echo "$BOT_GPG_KEY" | gpg --batch --import + echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --import git config user.name "Gitea Actions Bot" git config user.email "fishconfig-bot@git.rootiest.dev" - git config user.signingkey 0603CD87750C18FB3604147EFD08763FA41E5534 + git config user.signingkey CAA082C2F3467E1F7217AD492075C120312D23F4 git config commit.gpgsign true git add docs/fish-config.md docs/fish-config.1 conf.d/__fish_config_op_registry.fish git diff --cached --quiet && echo "No changes to commit" && exit 0