This is an automated email from the ASF dual-hosted git repository. zeroshade pushed a commit to branch release-for-terraform in repository https://gitbox.apache.org/repos/asf/terraform-provider-iceberg.git
commit 5c2ee112e02a73e315dc1c8d2477202085ca6653 Author: Matt Topol <[email protected]> AuthorDate: Wed Oct 14 13:19:51 2026 -0400 Update tf-release.yml to automate signing via iceberg private key --- .github/workflows/tf-release.yml | 9 ++++++++- dev/release/release_rc.sh | 34 +++++++++++++++++----------------- 2 files changed, 25 insertions(+), 18 deletions(-) diff --git a/.github/workflows/tf-release.yml b/.github/workflows/tf-release.yml index a00edd4..5ba6452 100644 --- a/.github/workflows/tf-release.yml +++ b/.github/workflows/tf-release.yml @@ -101,17 +101,24 @@ jobs: cache: false cache-dependency-path: go.sum + - name: Import GPG key + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 + id: import_gpg + with: + gpg_private_key: ${{ secrets.ICEBERG_GPG_SECRET_KEY }} + - name: Build artifacts with GoReleaser uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: version: '~> v2' # Build only; signing and publishing happen later. - args: release --clean --skip=sign,publish,validate + args: release --clean --skip=publish,validate env: # Name artifacts with the final version (0.7.0, not 0.7.0-rc1) so the # voted binaries can be promoted unchanged. Skipping validate lets this # override GoReleaser's tag-derived version. GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }} + GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} - name: Stage registry manifest env: diff --git a/dev/release/release_rc.sh b/dev/release/release_rc.sh index 1da2ccd..42947cb 100755 --- a/dev/release/release_rc.sh +++ b/dev/release/release_rc.sh @@ -138,23 +138,23 @@ if [ "${RELEASE_SIGN}" -gt 0 ]; then --repo "${repository}" \ "${id}/${rc_tar_gz}.asc" - echo "Signing the binary checksums (SHA256SUMS) for the registry" - rm -rf binaries-rc - mkdir -p binaries-rc - gh release download "${rc_tag}" \ - --dir binaries-rc \ - --pattern "${sha256sums}" \ - --repo "${repository}" \ - --skip-existing - ( - cd binaries-rc - gpg --batch --yes --detach-sign --output "${sha256sums}.sig" "${sha256sums}" - ) - echo "Adding the SHA256SUMS signature to the prerelease" - gh release upload "${rc_tag}" \ - --clobber \ - --repo "${repository}" \ - "binaries-rc/${sha256sums}.sig" + # Signatures are now done by CI via ATR + # rm -rf binaries-rc + # mkdir -p binaries-rc + # gh release download "${rc_tag}" \ + # --dir binaries-rc \ + # --pattern "${sha256sums}" \ + # --repo "${repository}" \ + # --skip-existing + # ( + # cd binaries-rc + # gpg --batch --yes --detach-sign --output "${sha256sums}.sig" "${sha256sums}" + # ) + # echo "Adding the SHA256SUMS signature to the prerelease" + # gh release upload "${rc_tag}" \ + # --clobber \ + # --repo "${repository}" \ + # "binaries-rc/${sha256sums}.sig" fi if [ "${RELEASE_UPLOAD}" -gt 0 ]; then
