ci: avoid passing GPG passphrase on command line in Java publish workflow#3313
Merged
wjones127 merged 1 commit intoMay 7, 2026
Merged
Conversation
…h workflow
Two issues are fixed:
1. `actions/setup-java` `gpg-passphrase` input expects an environment variable
NAME, not the secret value itself. The previous `${{ secrets.GPG_PASSPHRASE }}`
was incorrectly using the passphrase value as the env var name. Fixed to use
`MAVEN_GPG_PASSPHRASE` (the env var name), which is what setup-java uses to
generate the Maven settings.xml entry.
2. Removed `-Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}` from the Maven
command line. Passing secrets as CLI arguments makes them visible in process
listings and can be echoed in debug logs. The passphrase is now provided
via the `MAVEN_GPG_PASSPHRASE` environment variable, which `actions/setup-java`
has already wired into Maven's settings.xml.
Fixes lancedb#3299
Co-Authored-By: Octopus <[email protected]>
Contributor
|
ACTION NEEDED Lance follows the Conventional Commits specification for release automation. The PR title and description are used as the merge commit message. Please update your PR title and description to match the specification. For details on the error please inspect the "PR Title Check" action. |
wjones127
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3299
Problem
Two security issues exist in
.github/workflows/java-publish.yml:gpg-passphraseinput is misused:actions/setup-java'sgpg-passphraseinput expects the name of an environment variable (default:GPG_PASSPHRASE), not the secret value itself. The previous value${{ secrets.GPG_PASSPHRASE }}was setting the env var name to the actual secret, which is incorrect.Passphrase visible on the command line:
-Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}passes the GPG passphrase as a Maven system property argument, making it visible in process listings and potentially echoed in debug logs — a supply-chain security risk for release workflows.Solution
gpg-passphrase: MAVEN_GPG_PASSPHRASE— use the correct env var name soactions/setup-javagenerates a proper Mavensettings.xmlentry that reads fromMAVEN_GPG_PASSPHRASE.-Dgpg.passphrase=...from the Maven CLI invocation.MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}to theenv:block of the Publish step, so the passphrase is available as an environment variable rather than a CLI argument.Testing
The Java publish workflow only runs on tag pushes, so this cannot be exercised in a PR build. The logic change is straightforward:
actions/setup-javais documented to write asettings.xmlthat reads<gpg.passphrase>from the named env var, andmaven-gpg-pluginpicks it up from there without any CLI argument.