Test artifacts signature

.github/workflows/build.yaml

@@ -65,3 +65,48 @@ jobs:
           maven-version: ${{ matrix.maven }}
       - name: Build & Test
         run: mvn -B clean javadoc:jar
+  signature:
+    name: Sign artifacts
+    environment: test
+    env:
+      GPG_KEYNAME: ${{ env.GPG_KEYNAME }}
+      GPG_PASSPHRASE: ${{ env.GPG_PASSPHRASE }}
+      GPG_PRIVATE_KEY: ${{ env.GPG_PRIVATE_KEY }}
+      ARTIFACTS_DIR: target/artifacts
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+        java:
+          - 11
+        maven:
+          - 3.9.6
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: debug
+        run: |
+          echo $GPG_KEYNAME
+          echo $GPG_PASSPHRASE
+          echo $GPG_PRIVATE_KEY
+      - name: Prepare signature
+        run: echo -e "$GPG_PRIVATE_KEY" | gpg --import --batch
+      - uses: s4u/[email protected]
+        with:
+          java-distribution: 'temurin'
+          java-version: ${{ matrix.java }}
+          maven-version: ${{ matrix.maven }}
+      - name: Build & Test
+        run: mvn -B clean install -Prelease -DskipTests
+      - name: Collect artifacts
+        run: |
+          mkdir -p $ARTIFACTS_DIR
+          cp -r $HOME/.m2/repository/org/asciidoctor/asciidoctor-maven-* $ARTIFACTS_DIR
+          cp -r $HOME/.m2/repository/org/asciidoctor/*-doxia-module $ARTIFACTS_DIR
+      - name: Print jar signatures
+        run: find $ARTIFACTS_DIR -type f -name "*.jar" -exec gpg --verify "{}.asc" \;
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: signed-artifacts
+          path: ${{ env.ARTIFACTS_DIR }}

CHANGELOG.adoc

@@ -61,6 +61,7 @@ Build / Infrastructure::
   * Use latest maven-plugin-tools and remove Dependabot exclusion (CI test ensure backward compatibility) (#717)
   * Use latest Maven Doxia and remove Dependabot exclusion (CI test ensure backward compatibility) (#719)
   * Use latest Maven and remove Dependabot exclusion (CI test ensure backward compatibility) (#722)
+  * Test artifacts signature in CI (#725)
 
 Maintenance::
   * Replace use of reflection by direct JavaExtensionRegistry calls to register extensions (#596)

pom.xml

@@ -236,11 +236,13 @@
     <profiles>
         <profile>
             <!--
-              To release to bintray, add your credentials to ~/.m2/settings.xml and run:
-
+              To release, define environment variables:
+                export GPG_KEYNAME=""
+                export GPG_PASSPHRASE=""
+              Then, run
                $ mvn deploy
             -->
-            <id>release-profile</id>
+            <id>release</id>
             <build>
                 <plugins>
                     <plugin>
@@ -275,8 +277,8 @@
                         <artifactId>maven-gpg-plugin</artifactId>
                         <configuration>
                             <executable>gpg2</executable>
-                            <keyname>${gpg.keyname}</keyname>
-                            <passphrase>${gpg.passphrase}</passphrase>
+                            <keyname>${env.GPG_KEYNAME}</keyname>
+                            <passphrase>${env.GPG_PASSPHRASE}</passphrase>
                             <gpgArguments>
                                 <arg>--pinentry-mode</arg>
                                 <arg>loopback</arg>