(terraform-provider-iceberg) branch main updated: chore: update tf-release.yml to automate signing via iceberg private key (#133)

[zeroshade]

This is an automated email from the ASF dual-hosted git repository.

zeroshade pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/terraform-provider-iceberg.git


The following commit(s) were added to refs/heads/main by this push:
     new 99cd7d2  chore: update tf-release.yml to automate signing via iceberg 
private key (#133)
99cd7d2 is described below

commit 99cd7d21ac12a6560ec48996c850b20e39dcc180
Author: Matt Topol <zotthewiz...@gmail.com>
AuthorDate: Thu Oct 15 12:18:42 2026 +0100

    chore: update tf-release.yml to automate signing via iceberg private key 
(#133)
    
    Update tf-release.yml to automate signing via iceberg private key
---
 .github/workflows/tf-release.yml |  9 ++++++++-
 dev/release/release_rc.sh        | 34 +++++++++++++++++-----------------
 2 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/tf-release.yml b/.github/workflows/tf-release.yml
index a00edd4..5ba6452 100644
--- a/.github/workflows/tf-release.yml
+++ b/.github/workflows/tf-release.yml
@@ -101,17 +101,24 @@ jobs:
           cache: false
           cache-dependency-path: go.sum
 
+      - name: Import GPG key
+        uses: 
crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        id: import_gpg
+        with:
+          gpg_private_key: ${{ secrets.ICEBERG_GPG_SECRET_KEY }}
+
       - name: Build artifacts with GoReleaser
         uses: 
goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: '~> v2'
           # Build only; signing and publishing happen later.
-          args: release --clean --skip=sign,publish,validate
+          args: release --clean --skip=publish,validate
         env:
           # Name artifacts with the final version (0.7.0, not 0.7.0-rc1) so the
           # voted binaries can be promoted unchanged. Skipping validate lets 
this
           # override GoReleaser's tag-derived version.
           GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
 
       - name: Stage registry manifest
         env:
diff --git a/dev/release/release_rc.sh b/dev/release/release_rc.sh
index 1da2ccd..42947cb 100755
--- a/dev/release/release_rc.sh
+++ b/dev/release/release_rc.sh
@@ -138,23 +138,23 @@ if [ "${RELEASE_SIGN}" -gt 0 ]; then
     --repo "${repository}" \
     "${id}/${rc_tar_gz}.asc"
 
-  echo "Signing the binary checksums (SHA256SUMS) for the registry"
-  rm -rf binaries-rc
-  mkdir -p binaries-rc
-  gh release download "${rc_tag}" \
-    --dir binaries-rc \
-    --pattern "${sha256sums}" \
-    --repo "${repository}" \
-    --skip-existing
-  (
-    cd binaries-rc
-    gpg --batch --yes --detach-sign --output "${sha256sums}.sig" 
"${sha256sums}"
-  )
-  echo "Adding the SHA256SUMS signature to the prerelease"
-  gh release upload "${rc_tag}" \
-    --clobber \
-    --repo "${repository}" \
-    "binaries-rc/${sha256sums}.sig"
+  # Signatures are now done by CI via ATR
+  # rm -rf binaries-rc
+  # mkdir -p binaries-rc
+  # gh release download "${rc_tag}" \
+  #   --dir binaries-rc \
+  #   --pattern "${sha256sums}" \
+  #   --repo "${repository}" \
+  #   --skip-existing
+  # (
+  #   cd binaries-rc
+  #   gpg --batch --yes --detach-sign --output "${sha256sums}.sig" 
"${sha256sums}"
+  # )
+  # echo "Adding the SHA256SUMS signature to the prerelease"
+  # gh release upload "${rc_tag}" \
+  #   --clobber \
+  #   --repo "${repository}" \
+  #   "binaries-rc/${sha256sums}.sig"
 fi
 
 if [ "${RELEASE_UPLOAD}" -gt 0 ]; then