From 691cd9c2acbf005fc180505a5b5d5a6e8ce21ee8 Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Mon, 6 Jul 2026 18:33:40 +0530 Subject: [PATCH 1/4] ci: point kattu maven workflows at @develop to test kattu#353 Repoints maven-build / maven-publish-to-nexus / maven-sonar-analysis(-new) reusable-workflow references to mosip/kattu@develop so the GPG-key-import migration (mosip/kattu#353) is exercised by this repo's CI once it merges. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/push-trigger.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index c3ef6f3..a706766 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -23,7 +23,7 @@ on: jobs: build-maven-mock-plugin: - uses: mosip/kattu/.github/workflows/maven-build.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-build.yml@develop with: SERVICE_LOCATION: ./mock-plugin BUILD_ARTIFACT: mock-plugin @@ -37,7 +37,7 @@ jobs: publish-mock-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-mock-plugin - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop with: SERVICE_LOCATION: ./mock-plugin secrets: @@ -51,7 +51,7 @@ jobs: sonar-analysis-mock-plugin: needs: build-maven-mock-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@develop with: SERVICE_LOCATION: ./mock-plugin secrets: @@ -64,7 +64,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build-maven-mosip-identity-plugin: - uses: mosip/kattu/.github/workflows/maven-build.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-build.yml@develop with: SERVICE_LOCATION: ./mosip-identity-plugin BUILD_ARTIFACT: mosip-identity-plugin @@ -78,7 +78,7 @@ jobs: publish-mosip-identity-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-mosip-identity-plugin - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop with: SERVICE_LOCATION: ./mosip-identity-plugin secrets: @@ -92,7 +92,7 @@ jobs: sonar-analysis-mosip-identity-plugin: needs: build-maven-mosip-identity-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@develop with: SERVICE_LOCATION: ./mosip-identity-plugin secrets: @@ -105,7 +105,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build-maven-sunbird-rc-plugin: - uses: mosip/kattu/.github/workflows/maven-build.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-build.yml@develop with: SERVICE_LOCATION: ./sunbird-rc-plugin BUILD_ARTIFACT: sunbird-rc-plugin @@ -119,7 +119,7 @@ jobs: publish-sunbird-rc-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-sunbird-rc-plugin - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop with: SERVICE_LOCATION: ./sunbird-rc-plugin secrets: @@ -133,7 +133,7 @@ jobs: sonar-analysis-sunbird-rc-plugin: needs: build-maven-sunbird-rc-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@master-java21 + uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@develop with: SERVICE_LOCATION: ./sunbird-rc-plugin secrets: From 336b139023f58ff5c71cbd0bc0bab43ce32fbb52 Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Mon, 6 Jul 2026 19:07:16 +0530 Subject: [PATCH 2/4] ci: pass GPG_PRIVATE_KEY secret from caller workflows (kattu#353) kattu#353 imports the signing key from the GPG_PRIVATE_KEY secret (now required: true in maven-build / maven-publish-to-nexus workflow_call), so the caller must forward it. Added GPG_PRIVATE_KEY to the maven-build and maven-publish-to-nexus caller jobs only (sonar workflows don't declare it). Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/push-trigger.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index a706766..16c756a 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -32,6 +32,7 @@ jobs: OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} publish-mock-plugin-to-nexus: @@ -46,6 +47,7 @@ jobs: OSSRH_URL: ${{ secrets.OSSRH_CENTRAL_URL }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} sonar-analysis-mock-plugin: @@ -73,6 +75,7 @@ jobs: OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} publish-mosip-identity-plugin-to-nexus: @@ -87,6 +90,7 @@ jobs: OSSRH_URL: ${{ secrets.OSSRH_CENTRAL_URL }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} sonar-analysis-mosip-identity-plugin: @@ -114,6 +118,7 @@ jobs: OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} publish-sunbird-rc-plugin-to-nexus: @@ -128,6 +133,7 @@ jobs: OSSRH_URL: ${{ secrets.OSSRH_CENTRAL_URL }} OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }} GPG_SECRET: ${{ secrets.GPG_SECRET }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} sonar-analysis-sunbird-rc-plugin: From 28d8b65a7308daa136bede8ab453948e78657b11 Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Tue, 7 Jul 2026 13:38:26 +0530 Subject: [PATCH 3/4] ci: point maven workflows at Mahesh-Binayak/kattu@gpgupdate-masterj21 gpgupdate-masterj21 = master-java21 + the GPG-secret-import / key-age / simplify4u-pgpverify changes, keeping master-java21's interface intact. Repoints maven-build / maven-publish-to-nexus / maven-sonar-analysis to it, restores MAVEN_NON_EXEC_ARTIFACTS, and forwards GPG_PRIVATE_KEY to the build/publish jobs. Other workflows (docker-build, npm-*, sonar-new@develop) and commented refs are left unchanged. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/push-trigger.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index 16c756a..d09c9ca 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -23,7 +23,7 @@ on: jobs: build-maven-mock-plugin: - uses: mosip/kattu/.github/workflows/maven-build.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mock-plugin BUILD_ARTIFACT: mock-plugin @@ -38,7 +38,7 @@ jobs: publish-mock-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-mock-plugin - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mock-plugin secrets: @@ -53,7 +53,7 @@ jobs: sonar-analysis-mock-plugin: needs: build-maven-mock-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mock-plugin secrets: @@ -66,7 +66,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build-maven-mosip-identity-plugin: - uses: mosip/kattu/.github/workflows/maven-build.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mosip-identity-plugin BUILD_ARTIFACT: mosip-identity-plugin @@ -81,7 +81,7 @@ jobs: publish-mosip-identity-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-mosip-identity-plugin - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mosip-identity-plugin secrets: @@ -96,7 +96,7 @@ jobs: sonar-analysis-mosip-identity-plugin: needs: build-maven-mosip-identity-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mosip-identity-plugin secrets: @@ -109,7 +109,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build-maven-sunbird-rc-plugin: - uses: mosip/kattu/.github/workflows/maven-build.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./sunbird-rc-plugin BUILD_ARTIFACT: sunbird-rc-plugin @@ -124,7 +124,7 @@ jobs: publish-sunbird-rc-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-sunbird-rc-plugin - uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./sunbird-rc-plugin secrets: @@ -139,7 +139,7 @@ jobs: sonar-analysis-sunbird-rc-plugin: needs: build-maven-sunbird-rc-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@develop + uses: Mahesh-Binayak/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./sunbird-rc-plugin secrets: From 137f081f1859f9cdced918ef045a96f9d3e4f2eb Mon Sep 17 00:00:00 2001 From: "Mahesh.Binayak" Date: Tue, 7 Jul 2026 17:45:06 +0530 Subject: [PATCH 4/4] ci: point maven workflows at mosip/kattu@gpgupdate-masterj21 The gpgupdate-masterj21 branch now lives on mosip/kattu; reference it there instead of the fork. Interface unchanged; GPG_PRIVATE_KEY forwarded. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Mahesh.Binayak --- .github/workflows/push-trigger.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/push-trigger.yml b/.github/workflows/push-trigger.yml index d09c9ca..01f946b 100644 --- a/.github/workflows/push-trigger.yml +++ b/.github/workflows/push-trigger.yml @@ -23,7 +23,7 @@ on: jobs: build-maven-mock-plugin: - uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mock-plugin BUILD_ARTIFACT: mock-plugin @@ -38,7 +38,7 @@ jobs: publish-mock-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-mock-plugin - uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mock-plugin secrets: @@ -53,7 +53,7 @@ jobs: sonar-analysis-mock-plugin: needs: build-maven-mock-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: Mahesh-Binayak/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mock-plugin secrets: @@ -66,7 +66,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build-maven-mosip-identity-plugin: - uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mosip-identity-plugin BUILD_ARTIFACT: mosip-identity-plugin @@ -81,7 +81,7 @@ jobs: publish-mosip-identity-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-mosip-identity-plugin - uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mosip-identity-plugin secrets: @@ -96,7 +96,7 @@ jobs: sonar-analysis-mosip-identity-plugin: needs: build-maven-mosip-identity-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: Mahesh-Binayak/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./mosip-identity-plugin secrets: @@ -109,7 +109,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} build-maven-sunbird-rc-plugin: - uses: Mahesh-Binayak/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-build.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./sunbird-rc-plugin BUILD_ARTIFACT: sunbird-rc-plugin @@ -124,7 +124,7 @@ jobs: publish-sunbird-rc-plugin-to-nexus: if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' && github.event_name != 'release' && github.event_name != 'prerelease' && github.event_name != 'publish' }}" needs: build-maven-sunbird-rc-plugin - uses: Mahesh-Binayak/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./sunbird-rc-plugin secrets: @@ -139,7 +139,7 @@ jobs: sonar-analysis-sunbird-rc-plugin: needs: build-maven-sunbird-rc-plugin if: "${{ github.event_name != 'pull_request' }}" - uses: Mahesh-Binayak/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 + uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@gpgupdate-masterj21 with: SERVICE_LOCATION: ./sunbird-rc-plugin secrets: