fix

zeitlinger · zeitlinger · commit f8f679ce61b0 · 2026-06-04T15:57:02.000+02:00
Signed-off-by: Gregor Zeitlinger &lt;gregor.zeitlinger@grafana.com&gt;
diff --git a/.github/workflows/acceptance-tests.yml b/.github/workflows/acceptance-tests.yml
@@ -12,7 +12,7 @@ jobs:
       - name: Check out
         with:
           persist-credentials: false
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
           version: v2026.5.18
diff --git a/.github/workflows/api-diff.yml b/.github/workflows/api-diff.yml
@@ -32,7 +32,7 @@ jobs:
         ${{ contains(github.event.pull_request.labels.*.name, 'breaking-api-change-accepted') }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -9,7 +9,7 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -21,7 +21,7 @@ jobs:
       security-events: write # required for github/codeql-action/analyze to upload SARIF
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/generate-api-diff-baseline.yml b/.github/workflows/generate-api-diff-baseline.yml
@@ -29,7 +29,7 @@ jobs:
     permissions:
       contents: read # checkout + read-only `git fetch origin main` for the verify step
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.ref }}
           persist-credentials: false
@@ -90,7 +90,7 @@ jobs:
     permissions:
       contents: write # push regenerated docs/apidiffs back to the renovate branch
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.ref }}
           # zizmor: ignore[artipacked] -- needs credentials to push
diff --git a/.github/workflows/generate-protobuf.yml b/.github/workflows/generate-protobuf.yml
@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read # checkout + read-only `git fetch origin main` for the verify step
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.ref }}
           persist-credentials: false
@@ -66,7 +66,7 @@ jobs:
     permissions:
       contents: write # push regenerated sources back to the renovate branch
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.ref }}
           # zizmor: ignore[artipacked] -- needs credentials to push
diff --git a/.github/workflows/github-pages.yaml b/.github/workflows/github-pages.yaml
@@ -32,7 +32,7 @@ jobs:
     if: github.repository == 'prometheus/client_java'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
           fetch-tags: "true"
diff --git a/.github/workflows/jmx-exporter-compatibility.yml b/.github/workflows/jmx-exporter-compatibility.yml
@@ -19,7 +19,7 @@ jobs:
   jmx-exporter-compatibility:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
diff --git a/.github/workflows/multi-version-test.yml b/.github/workflows/multi-version-test.yml
@@ -15,7 +15,7 @@ jobs:
         java: [17, 21, 25]
     steps:
       - name: Check out
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/native-tests.yml b/.github/workflows/native-tests.yml
@@ -12,7 +12,7 @@ jobs:
       - name: Check out
         with:
           persist-credentials: false
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
           version: v2026.5.18
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -18,52 +18,14 @@ jobs:
     permissions: {}
 
     steps:
-      - name: Verify release secrets
+      - name: Debug gpg key
         env:
-          MAVEN_USERNAME: ${{ secrets.SONATYPE_MAVEN_REPOSITORY_USERNAME }}
-          MAVEN_CENTRAL_TOKEN: ${{ secrets.SONATYPE_MAVEN_REPOSITORY_PASSWORD }}
           GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
-          GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
         run: |
-          fail() {
-            echo "::error::$1"
-            echo "::error::Fix: see '$2' in RELEASING.md"
-            exit 1
-          }
-
-          # Sonatype token
-          response=$(curl -s -u "${MAVEN_USERNAME}:${MAVEN_CENTRAL_TOKEN}" \
-            "https://central.sonatype.com/api/v1/publisher/status?id=test")
-          echo "Sonatype response: ${response}"
-          if echo "${response}" | grep -q "Invalid token"; then
-            fail "Sonatype Central token is invalid." \
-              "If the Sonatype Central Token is Invalid"
-          fi
-
-          # GPG key import
-          if ! echo "${GPG_SIGNING_KEY}" | gpg --batch --import 2>&1 | \
-              tee /tmp/gpg-import.log | grep -q "secret key imported\|secret keys read"; then
-            cat /tmp/gpg-import.log
-            fail "GPG_SIGNING_KEY did not import a secret key." \
-              "If the GPG Key Expired"
-          fi
-
-          # GPG passphrase
-          key_id=$(gpg --list-secret-keys --with-colons | \
-            awk -F: '/^sec:/ { print $5; exit }')
-          if [ -z "${key_id}" ]; then
-            fail "No secret key available after import." \
-              "If the GPG Key Expired"
-          fi
-          if ! echo "test" | gpg --batch --pinentry-mode loopback \
-              --passphrase "${GPG_SIGNING_PASSPHRASE}" \
-              -u "${key_id}" --clearsign >/dev/null 2>/tmp/gpg-sign.log; then
-            cat /tmp/gpg-sign.log
-            fail "GPG_SIGNING_PASSPHRASE does not match GPG_SIGNING_KEY." \
-              "If the GPG Key Expired"
-          fi
+          echo "${#GPG_SIGNING_KEY}"
+          echo "${GPG_SIGNING_KEY}" | gpg --batch --import-options import-show --import
       - name: Checkout Plugin Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ inputs.tag }}
           persist-credentials: false
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -22,7 +22,7 @@ jobs:
       id-token: write # required by scorecard-action for OIDC token
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/test-release-build.yml b/.github/workflows/test-release-build.yml
@@ -13,7 +13,7 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
           fetch-tags: "true"
