From 302a0c562423f2baa6aee75d116aae8c4d1af501 Mon Sep 17 00:00:00 2001 From: Devid HW Date: Wed, 26 Aug 2026 05:14:50 +0700 Subject: [PATCH] =?UTF-8?q?fix(ci):=20move=20GPG=20signing=20guard=20out?= =?UTF-8?q?=20of=20step=20if:=20=E2=80=94=20secrets=20context=20invalid=20?= =?UTF-8?q?there?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Referencing secrets.* in a step-level if: expression makes GitHub reject the whole workflow file at parse time: every push to any branch produced a startup-failure run for release.yml with zero jobs ('Code Scanning could not...' style runs named .github/workflows/release.yml). The tags trigger was irrelevant because an unparseable workflow has no readable triggers. Fix: evaluate the both-secrets-present check in job-level env (where the secrets context IS allowed) and test env.HAS_GPG_SECRETS in the step if:. Behavior unchanged: sign when both secrets exist, ship unsigned otherwise. --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 06ad4dd..5089d70 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -143,6 +143,11 @@ jobs: contents: write env: RELEASE_TAG: ${{ github.event.inputs.version || github.ref_name }} + # secrets context is NOT available in step-level if: expressions — + # referencing it there makes the whole workflow fail validation + # (startup-failure runs on every push). Route the check through a + # job-level env var instead: env IS readable in if:. + HAS_GPG_SECRETS: ${{ secrets.GPG_PRIVATE_KEY != '' && secrets.GPG_PASSPHRASE != '' }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -165,7 +170,7 @@ jobs: # each binary gets a detached ASCII-armored signature and the public key # (docs/signing-key.asc) is attached to the release for verification. - name: Import GPG key and sign artifacts - if: ${{ secrets.GPG_PRIVATE_KEY != '' && secrets.GPG_PASSPHRASE != '' }} + if: env.HAS_GPG_SECRETS == 'true' env: GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}