Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server - #1123
Merged
brunoborges merged 7 commits intoJul 15, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
The maven-gpg-plugin's `gpg.passphrase`/`passphraseServerId` mechanism is deprecated and fails when the plugin's `bestPractices` mode is enabled. Stop writing the `gpg.passphrase` server to settings.xml and instead set `gpg.passphraseEnvName` via an active profile when the configured passphrase env var name differs from the plugin default (MAVEN_GPG_PASSPHRASE). The default `gpg-passphrase` input value (GPG_PASSPHRASE) is unchanged, so the plugin reads the same environment variable as before. Fixes #760 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Update the publishing e2e check to assert the settings.xml generated when gpg-passphrase is MAVEN_GPG_PASSPHRASE. In that default case the action no longer writes a gpg.passphrase server entry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Updates actions/setup-java Maven settings.xml generation to stop using the deprecated gpg.passphrase server mechanism and instead configure the Maven GPG Plugin via gpg.passphraseEnvName (only when the configured env var name differs from the plugin default MAVEN_GPG_PASSPHRASE). This aligns setup-java with the Maven GPG Plugin’s recommended configuration and avoids failures when bestPractices is enabled.
Changes:
- Add constants for the Maven GPG Plugin default passphrase env var name and a dedicated settings profile id.
- Update src/auth.ts to write an active settings.xml profile that sets gpg.passphraseEnvName instead of writing a gpg.passphrase server.
- Update docs and tests to reflect the new mechanism (and regenerate dist/ output).
| File | Description |
|---|---|
| src/constants.ts | Introduces constants for Maven GPG Plugin default env var name and settings profile id. |
| src/auth.ts | Switches from writing gpg.passphrase server to writing an active profile that sets gpg.passphraseEnvName when needed. |
| docs/advanced-usage.md | Updates guidance and examples to describe the gpg.passphraseEnvName approach and deprecation of the old server mechanism. |
| tests/auth.test.ts | Updates/extends settings.xml generation assertions for the new profile-based behavior (including the “plugin default env var” case). |
| dist/setup/index.js | Regenerated distribution output reflecting the updated settings.xml generation behavior. |
| dist/cleanup/index.js | Regenerated distribution output reflecting updated constants. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 5/7 changed files
- Comments generated: 1
- Review effort level: Low
Sorry, something went wrong.
Comment thread
docs/advanced-usage.md
Outdated
Align the default `gpg-passphrase` input value with the maven-gpg-plugin default environment variable name (MAVEN_GPG_PASSPHRASE). With this default, setup-java writes no extra GPG configuration to settings.xml and the plugin reads the passphrase from MAVEN_GPG_PASSPHRASE out of the box. Also document that reading the passphrase from an environment variable via `gpg.passphraseEnvName` requires maven-gpg-plugin 3.2.0 or newer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1
Add a "Breaking changes in V6" section to the README covering the switch to gpg.passphraseEnvName, the new MAVEN_GPG_PASSPHRASE default, and the maven-gpg-plugin 3.2.0+ requirement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1
Revert the gpg-passphrase input default back to GPG_PASSPHRASE so existing v5 workflows that set the GPG_PASSPHRASE environment variable keep working without changes. setup-java writes gpg.passphraseEnvName=GPG_PASSPHRASE into an active profile, so the maven-gpg-plugin reads the same variable as before. The only remaining compatibility requirement is maven-gpg-plugin 3.2.0+, which is documented in the README and advanced usage guide. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
The maven-gpg-plugin's gpg.passphrase / passphraseServerId mechanism (a <server id="gpg.passphrase"> entry in settings.xml) is deprecated, and it fails outright once the plugin's bestPractices mode is enabled. This PR switches setup-java to the plugin's recommended gpg.passphraseEnvName mechanism.
Approach:
Compatibility:
Docs (README.md, docs/advanced-usage.md) were updated to describe the new mechanism and the version requirement. The e2e-publishing.yml settings.xml validation was updated to assert the new generated output.
Related issue:
Fixes: #760
Check list: