@@ -112,7 +112,10 @@ jobs:
112112 GPG_KEY_ID : ${{ secrets.GPG_KEY_ID }}
113113 run : |
114114 echo "$GPG_PRIVATE_KEY" | base64 -d | gpg --batch --import
115+
116+ # Set ownertrust to ultimate (requires full 40-char fingerprint)
115117 echo "${GPG_KEY_ID}:6:" | gpg --import-ownertrust
118+
116119 # Verify the key is available
117120 gpg --list-secret-keys --keyid-format LONG
118121
@@ -124,7 +127,6 @@ jobs:
124127 DISTRO="${{ matrix.distro }}"
125128 DATE=$(date -R)
126129 # Debian changelog format is strict about whitespace.
127- # Use printf to avoid heredoc indentation issues.
128130 printf 'odooctl (%s) %s; urgency=medium\n\n * Release %s\n\n -- mart337i <%s> %s\n' \
129131 "$VERSION" "$DISTRO" "$VERSION" "$GPG_EMAIL" "$DATE" \
130132 > debian/changelog
@@ -137,12 +139,12 @@ jobs:
137139 - name: Build signed source package
138140 env:
139141 GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
140- GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
141142 run: |
142- # Build source-only package, signed with our GPG key
143+ # Build source-only package, signed with our GPG key.
144+ # --pinentry-mode loopback + --passphrase '' handles keys with no passphrase.
143145 dpkg-buildpackage -S -sa \
144146 -k"${GPG_KEY_ID}" \
145- -p"gpg --batch --pinentry-mode loopback --passphrase '${GPG_PASSPHRASE} '"
147+ -p"gpg --batch --pinentry-mode loopback --passphrase ''"
146148
147149 mkdir -p dist
148150 cp ../*.dsc ../*.tar.* ../*_source.changes ../*_source.buildinfo dist/ 2>/dev/null || true
@@ -152,16 +154,15 @@ jobs:
152154 - name: Upload to Launchpad PPA
153155 env:
154156 GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
155- GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
156157 run: |
157158 # Configure dput for Launchpad
158159 printf '[odooctl-ppa]\nfqdn = ppa.launchpad.net\nmethod = ftp\nincoming = ~mart337i/ubuntu/odooctl/\nlogin = anonymous\nallow_unsigned_uploads = 0\n' > ~/.dput.cf
159160
160161 CHANGES_FILE=$(ls dist/*_source.changes | head -1)
161162
162- # debsign the .changes file (may already be signed, but be safe)
163+ # debsign the .changes file
163164 debsign -k"${GPG_KEY_ID}" \
164- -p"gpg --batch --pinentry-mode loopback --passphrase '${GPG_PASSPHRASE} '" \
165+ -p"gpg --batch --pinentry-mode loopback --passphrase ''" \
165166 "$CHANGES_FILE"
166167
167168 echo "Uploading to PPA..."
0 commit comments