ci: add Gradle/BouncyCastle signing-key preflight (cross-repo sync) - #139
Merged
Merged
Conversation
Adds the `verify-signing-key-gradle` job + the throwaway
.github/signing-selftest/ project, byte-identical to the sibling repos.
It validates the release GPG key can sign via Gradle's useInMemoryPgpKeys
(BouncyCastle) — a stricter parser than gpg — even though this repo does not
publish via Gradle yet ("prepared for Gradle"). Standalone, parallel at
pipeline start, environment: maven-central, prints no secret material.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018pwn51YPBbtiuUyiLRrfrG
bernardladenthin
had a problem deploying
to
maven-central
July 9, 2026 10:48 — with 
GitHub Actions
Failure
GitHub Actions
Failure
bernardladenthin
had a problem deploying
to
startgate
July 9, 2026 10:48 — with
GitHub Actions
Error
GitHub Actions
Error
bernardladenthin
had a problem deploying
to
maven-central
July 9, 2026 10:48 — with
GitHub Actions
Failure
GitHub Actions
Failure
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
verify-signing-key-gradlejob + the throwaway.github/signing-selftest/Gradle project, byte-identical to the sibling repos. It validates the release GPG key can also sign via Gradle'suseInMemoryPgpKeys(BouncyCastle), a stricter armored-key parser than gpg. This repo doesn't publish via Gradle yet; it's kept identical as a "prepared for Gradle" canary (a deliberate uniformity choice).verify-signing-key(gpg) job already onmain. Standalone (noneeds:), parallel at pipeline start,environment: maven-central; prints no secret material.Test plan
verify-signing-key-gradleruns green onmain(readsmaven-centralenv secretsGPG_PRIVATE_KEY/GPG_PASSPHRASE/GPG_KEY_ID; signs the throwaway artifact via subkey07D2D767).maven-centralenvironment gate rejects non-mainrefs before a runner starts.Related issues / PRs
Cross-repo synchronization of the signing-key preflight (origin: java-llama.cpp #306 / #307).
Checklist
GPG_KEY_IDis a public key id (07D2D767); the private key and passphrase never appear in any log.🤖 Generated with Claude Code
Generated by Claude Code