You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iceberg.apache.org by ze...@apache.org on 2026/10/14 17:20:16 UTC
(terraform-provider-iceberg) branch release-for-terraform created (now 5c2ee11)
This is an automated email from the ASF dual-hosted git repository.
zeroshade pushed a change to branch release-for-terraform
in repository https://gitbox.apache.org/repos/asf/terraform-provider-iceberg.git
at 5c2ee11 Update tf-release.yml to automate signing via iceberg private key
This branch includes the following new commits:
new 5c2ee11 Update tf-release.yml to automate signing via iceberg private key
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(terraform-provider-iceberg) 01/01: Update tf-release.yml to automate signing via iceberg private key
Posted by ze...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zeroshade pushed a commit to branch release-for-terraform
in repository https://gitbox.apache.org/repos/asf/terraform-provider-iceberg.git
commit 5c2ee112e02a73e315dc1c8d2477202085ca6653
Author: Matt Topol <zo...@gmail.com>
AuthorDate: Wed Oct 14 13:19:51 2026 -0400
Update tf-release.yml to automate signing via iceberg private key
---
.github/workflows/tf-release.yml | 9 ++++++++-
dev/release/release_rc.sh | 34 +++++++++++++++++-----------------
2 files changed, 25 insertions(+), 18 deletions(-)
diff --git a/.github/workflows/tf-release.yml b/.github/workflows/tf-release.yml
index a00edd4..5ba6452 100644
--- a/.github/workflows/tf-release.yml
+++ b/.github/workflows/tf-release.yml
@@ -101,17 +101,24 @@ jobs:
cache: false
cache-dependency-path: go.sum
+ - name: Import GPG key
+ uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+ id: import_gpg
+ with:
+ gpg_private_key: ${{ secrets.ICEBERG_GPG_SECRET_KEY }}
+
- name: Build artifacts with GoReleaser
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
with:
version: '~> v2'
# Build only; signing and publishing happen later.
- args: release --clean --skip=sign,publish,validate
+ args: release --clean --skip=publish,validate
env:
# Name artifacts with the final version (0.7.0, not 0.7.0-rc1) so the
# voted binaries can be promoted unchanged. Skipping validate lets this
# override GoReleaser's tag-derived version.
GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
+ GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
- name: Stage registry manifest
env:
diff --git a/dev/release/release_rc.sh b/dev/release/release_rc.sh
index 1da2ccd..42947cb 100755
--- a/dev/release/release_rc.sh
+++ b/dev/release/release_rc.sh
@@ -138,23 +138,23 @@ if [ "${RELEASE_SIGN}" -gt 0 ]; then
--repo "${repository}" \
"${id}/${rc_tar_gz}.asc"
- echo "Signing the binary checksums (SHA256SUMS) for the registry"
- rm -rf binaries-rc
- mkdir -p binaries-rc
- gh release download "${rc_tag}" \
- --dir binaries-rc \
- --pattern "${sha256sums}" \
- --repo "${repository}" \
- --skip-existing
- (
- cd binaries-rc
- gpg --batch --yes --detach-sign --output "${sha256sums}.sig" "${sha256sums}"
- )
- echo "Adding the SHA256SUMS signature to the prerelease"
- gh release upload "${rc_tag}" \
- --clobber \
- --repo "${repository}" \
- "binaries-rc/${sha256sums}.sig"
+ # Signatures are now done by CI via ATR
+ # rm -rf binaries-rc
+ # mkdir -p binaries-rc
+ # gh release download "${rc_tag}" \
+ # --dir binaries-rc \
+ # --pattern "${sha256sums}" \
+ # --repo "${repository}" \
+ # --skip-existing
+ # (
+ # cd binaries-rc
+ # gpg --batch --yes --detach-sign --output "${sha256sums}.sig" "${sha256sums}"
+ # )
+ # echo "Adding the SHA256SUMS signature to the prerelease"
+ # gh release upload "${rc_tag}" \
+ # --clobber \
+ # --repo "${repository}" \
+ # "binaries-rc/${sha256sums}.sig"
fi
if [ "${RELEASE_UPLOAD}" -gt 0 ]; then