From 5cc2588d8edbba790f52fd3ee78a5cea1ea59442 Mon Sep 17 00:00:00 2001
From: jadamcrain <jadamcrain@gmail.com>
Date: Wed, 28 Oct 2026 14:14:47 -0700
Subject: [PATCH] Import the signing subkey with gpg

---
 .github/workflows/ci.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 72ccdd4a..c82d6583 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -591,12 +591,15 @@ jobs:
         with:
           path: artifacts
           pattern: java-bindings-*
+      # The secret holds only the signing subkey, with the primary key as a stub, so there's nothing to
+      # unlock here: the signing below passes the passphrase itself
       - name: Import PGP key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
-        with:
-          gpg_private_key: ${{ secrets.SFIO_PGP_PRIVATE_KEY }}
-          passphrase: ${{ secrets.SFIO_PGP_PRIVATE_KEY_PASSPHRASE }}
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.SFIO_PGP_PRIVATE_KEY }}
+        run: |
+          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
+          echo "fingerprint=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr/{print $10; exit}')" >> "$GITHUB_OUTPUT"
       # Succeeds only once the version is published on Maven Central, not when the upload is accepted
       - name: Deploy Java to Maven Central
         shell: bash