Merge pull request #663 from tvbeek/phar_file_signing

Setup the signing of the phar file. Needed for Phive #397
pdepend · Apr 15, 2023 · 3163be6 · 3163be6
2 parents 3082a95 + e70efc7
commit 3163be6
Showing 1 changed file with 14 additions and 5 deletions.
diff --git a/.github/workflows/phar.yml b/.github/workflows/phar.yml
@@ -55,16 +55,25 @@ jobs:
           ant package -D-phar:filename=./pdepend.phar;
           ./pdepend.phar --version;
 
-      - name: Upload pdepend.phar
-        uses: actions/upload-artifact@v2
+      - name: Sign phar
+        env:
+          PASSPHRASE: ${{ secrets.PASSPHRASE }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: gpg --command-fd 0 --pinentry-mode loopback -u pgp@pdepend.org --batch --detach-sign --output pdepend.phar.asc pdepend.phar
+
+      - name: Upload pdepend.phar and pdepend.phar.asc
+        uses: actions/upload-artifact@v3
         with:
-          name: pdepend.phar
-          path: pdepend.phar
+          path: |
+            pdepend.phar
+            pdepend.phar.asc
 
       - name: Release pdepend.phar
         if: github.event_name == 'release'
         uses: skx/github-action-publish-binaries@master
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          args: 'pdepend.phar'
+          args: |
+            pdepend.phar
+            pdepend.phar.asc