public-mirrors
/
composer
mirror of https://github.com/composer/composer
1
0
Fork 0
Code

Try and sign phars on releases, refs #5155

pull/9374/head
Jordi Boggiano 2020-10-27 15:55:21 +01:00
parent 568d9206cc
commit 44dc3c27aa
No known key found for this signature in database
GPG Key ID: 7BBD42C429EC80BC
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
.github/workflows/release.yml vendored
View File

@ -57,6 +57,27 @@ jobs:
asset_name: composer.phar asset_name: composer.phar
asset_content_type: application/octet-stream asset_content_type: application/octet-stream
- name: Configure GPG key and sign phar
run: |
mkdir -p ~/.gnupg/
chmod 0700 ~/.gnupg/
echo "$GPG_SIGNING_KEY" > ~/.gnupg/private.key
gpg --import ~/.gnupg/private.key
gpg -u contact@packagist.com --detach-sign --output composer.phar.asc composer.phar
env:
GPG_SIGNING_KEY: |
${{ secrets.GPG_KEY_161DFBE342889F01DDAC4E61CBB3D576F2A0946F }}
- name: Upload phar signature
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./composer.phar.asc
asset_name: composer.phar.asc
asset_content_type: application/octet-stream
# This step requires a secret token with `pull` access to composer/docker. The default # This step requires a secret token with `pull` access to composer/docker. The default
# secrets.GITHUB_TOKEN is scoped to this repository only which is not sufficient. # secrets.GITHUB_TOKEN is scoped to this repository only which is not sufficient.
- name: "Open issue @ Docker repository" - name: "Open issue @ Docker repository"