ppkarwasz opened a new pull request, #494: URL: https://github.com/apache/logging-parent/pull/494
Makes `GPG_SECRET_KEY` optional in `deploy-site-reusable`: - The secret is now declared `required: false`. - Commit signing is driven by `commit.gpgsign`, set based on the presence of `secrets.GPG_SECRET_KEY`. - The hardcoded `git commit -S` flags are removed, since they would force signing and fail without a key. We don't really need a GPG key to assert the provenance of commits on our website branches. If we want to have provenance data, we can use SLSA source provenance attestation to know what workflow generated the commit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
