Skip to content

Commit e25b4b5

Browse files
Copilotdevakesu
Copilot
and
devakesu
committed
feat: add GPG email configuration and setup documentation
- Update auto-version-bump.yml to support custom GPG committer email - Add fallback to user's GitHub no-reply email - Create comprehensive GPG setup guide in docs/GPG_SETUP.md - Add comments explaining email verification requirement Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>
1 parent 9cfcb71 commit e25b4b5

File tree

2 files changed

+159
-2
lines changed

2 files changed

+159
-2
lines changed

‎.github/workflows/auto-version-bump.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,10 @@ jobs:
6363
git_user_signingkey: true
6464
git_commit_gpgsign: true
6565
git_config_global: true
66-
git_committer_name: github-actions[bot]
67-
git_committer_email: github-actions[bot]@users.noreply.github.com
66+
# IMPORTANT: Use the same name and email as in your GPG key
67+
# This email MUST be verified in your GitHub account for commits to show as "Verified"
68+
git_committer_name: ${{ secrets.GPG_COMMITTER_NAME || 'GhostClass Bot' }}
69+
git_committer_email: ${{ secrets.GPG_COMMITTER_EMAIL || '61821107+devakesu@users.noreply.github.com' }}
6870

6971
- name: Setup Node.js
7072
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0

‎docs/GPG_SETUP.md‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# GPG Key Setup for Auto-Version-Bump Workflow
2+
3+
This guide explains how to generate a GPG key and configure it for the auto-version-bump workflow to create verified commits.
4+
5+
## Prerequisites
6+
7+
- GPG installed on your local machine
8+
- Access to repository Settings → Secrets and variables → Actions
9+
- A verified email address in your GitHub account
10+
11+
## Step 1: Generate a GPG Key
12+
13+
Run the following commands on your local machine:
14+
15+
```bash
16+
# Generate a new GPG key
17+
gpg --full-generate-key
18+
```
19+
20+
When prompted:
21+
1. **Key type**: Select `(1) RSA and RSA (default)`
22+
2. **Key size**: Enter `4096`
23+
3. **Key validity**: Enter `0` (key does not expire) or set an expiration
24+
4. **Real name**: Enter your name (e.g., "Your Name" or "GhostClass Bot")
25+
5. **Email address**: Enter your verified GitHub email (e.g., `yourname@example.com` or `61821107+devakesu@users.noreply.github.com`)
26+
6. **Comment**: Optional, can leave blank
27+
7. **Passphrase**: Enter a strong passphrase (you'll need this later)
28+
29+
## Step 2: Export Your GPG Key
30+
31+
After generating the key, export it:
32+
33+
```bash
34+
# List your GPG keys to get the key ID
35+
gpg --list-secret-keys --keyid-format=long
36+
37+
# You'll see output like:
38+
# sec rsa4096/ABC123DEF456 2024-01-01 [SC]
39+
# 1234567890ABCDEF1234567890ABCDEF12345678
40+
# uid [ultimate] Your Name <your-email@example.com>
41+
# ssb rsa4096/XYZ789ABC123 2024-01-01 [E]
42+
43+
# Export the private key (replace ABC123DEF456 with your key ID)
44+
gpg --armor --export-secret-keys ABC123DEF456
45+
46+
# Export the public key
47+
gpg --armor --export ABC123DEF456
48+
```
49+
50+
## Step 3: Add GPG Key to GitHub Account
51+
52+
1. Go to GitHub → Settings → SSH and GPG keys
53+
2. Click "New GPG key"
54+
3. Paste your **public key** (the output from `gpg --armor --export`)
55+
4. Click "Add GPG key"
56+
57+
## Step 4: Verify Your Email Address
58+
59+
1. Go to GitHub → Settings → Emails
60+
2. Ensure the email address used in your GPG key is listed and verified
61+
3. If not verified, click "Resend verification email" and follow the link
62+
63+
## Step 5: Add Secrets to Repository
64+
65+
Go to your repository → Settings → Secrets and variables → Actions, and add:
66+
67+
### Required Secrets:
68+
69+
1. **GPG_PRIVATE_KEY**
70+
- Value: Your private key (output from `gpg --armor --export-secret-keys`)
71+
- This is the entire output including:
72+
```
73+
-----BEGIN PGP PRIVATE KEY BLOCK-----
74+
...
75+
-----END PGP PRIVATE KEY BLOCK-----
76+
```
77+
78+
2. **GPG_PASSPHRASE**
79+
- Value: The passphrase you set when generating the key
80+
81+
### Optional Secrets (recommended):
82+
83+
3. **GPG_COMMITTER_NAME**
84+
- Value: The name to use for commits (e.g., "GhostClass Bot" or your name)
85+
- If not set, defaults to "GhostClass Bot"
86+
87+
4. **GPG_COMMITTER_EMAIL**
88+
- Value: The email address from your GPG key (must be verified in GitHub)
89+
- If not set, defaults to "61821107+devakesu@users.noreply.github.com"
90+
91+
## Step 6: Test the Setup
92+
93+
1. Create a test PR to trigger the auto-version-bump workflow
94+
2. Check that the version bump commit shows as "Verified" with a green checkmark
95+
3. Verify the commit is signed with your GPG key
96+
97+
## Using GitHub's No-Reply Email
98+
99+
If you want to keep your email private, you can use GitHub's no-reply email:
100+
101+
1. Go to GitHub → Settings → Emails
102+
2. Check "Keep my email addresses private"
103+
3. GitHub will provide you with a no-reply email like: `123456+username@users.noreply.github.com`
104+
4. Use this email when generating your GPG key
105+
5. This email is automatically verified
106+
107+
## Troubleshooting
108+
109+
### Commits Show as "Unverified"
110+
111+
- **Cause**: Email address in GPG key doesn't match a verified email in your GitHub account
112+
- **Solution**:
113+
1. Verify the email in GitHub Settings → Emails
114+
2. Or generate a new GPG key with a verified email address
115+
116+
### "No secret key" Error
117+
118+
- **Cause**: Private key not properly added to repository secrets
119+
- **Solution**: Ensure you copied the entire private key including headers and footers
120+
121+
### "Bad passphrase" Error
122+
123+
- **Cause**: Incorrect passphrase in repository secrets
124+
- **Solution**: Double-check the GPG_PASSPHRASE secret matches your key's passphrase
125+
126+
## Security Best Practices
127+
128+
1. **Never share your private key**: Only add it to repository secrets, never commit it
129+
2. **Use a strong passphrase**: Protect your GPG key with a strong passphrase
130+
3. **Rotate keys periodically**: Consider setting an expiration date and rotating keys
131+
4. **Backup your key**: Keep a secure backup of your GPG key
132+
5. **Use repository secrets**: Never hardcode sensitive information in workflow files
133+
134+
## Example Configuration
135+
136+
After setup, your workflow will use:
137+
138+
```yaml
139+
- name: Import GPG key (same-repo only)
140+
uses: crazy-max/ghaction-import-gpg@v6.1.0
141+
with:
142+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
143+
passphrase: ${{ secrets.GPG_PASSPHRASE }}
144+
git_user_signingkey: true
145+
git_commit_gpgsign: true
146+
git_config_global: true
147+
git_committer_name: ${{ secrets.GPG_COMMITTER_NAME || 'GhostClass Bot' }}
148+
git_committer_email: ${{ secrets.GPG_COMMITTER_EMAIL || '61821107+devakesu@users.noreply.github.com' }}
149+
```
150+
151+
## Additional Resources
152+
153+
- [GitHub: Managing commit signature verification](https://docs.github.com/en/authentication/managing-commit-signature-verification)
154+
- [GitHub: Generating a new GPG key](https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key)
155+
- [GitHub: Adding a GPG key to your GitHub account](https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account)

0 commit comments

Comments
 (0)