Purpose

Extend GitHub Action to support GPG signing for commits and tags as an alternative to SSH signing. Enforce mutual exclusivity between signing methods.

Rationale

Users need GPG signing capability for organizational compliance or personal preference. GPG and SSH signing configurations conflict at the git level—enabling both creates ambiguous signing behavior. Solution enforces exclusive use of one method with clear error messaging.

Implementation approach:

• Early validation - Check for conflicting keys before any git configuration
• Machine-readable parsing - Use gpg --with-colons format to avoid fragile output parsing
• Non-interactive operation - Configure loopback pinentry and batch mode for Docker environment
• Optional passphrase support - Handle both encrypted and unencrypted keys via gpg-agent preset

How did you test?

Validation logic:

• Created test suite with 3 mutual exclusivity scenarios (both SSH keys + GPG, SSH public + GPG, SSH private + GPG)
• Verified error messages appear correctly for each conflict case
• Validated bash syntax and POSIX compliance of shell scripts
• Fixed test runner issue where helper function was being detected as a test case (renamed test_mutual_exclusivity to verify_mutual_exclusivity)

GPG implementation:

• Confirmed machine-readable GPG output parsing handles both uppercase and lowercase hex
• Verified key ID extraction and validation regex patterns
• Ensured proper error handling when GPG operations fail

Edge cases covered:

• Missing keygrip extraction (falls back to loopback pinentry only)
• Malformed key IDs (warning issued but continues)
• Missing gpg-preset-passphrase utility (graceful degradation)
• Helper function naming collision with test runner pattern matching

How to Verify

Test mutual exclusivity:

- uses: python-semantic-release/python-semantic-release@branch
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    ssh_public_signing_key: ${{ secrets.SSH_PUBLIC }}
    gpg_private_signing_key: ${{ secrets.GPG_PRIVATE }}  # Should fail

Test GPG signing:

- uses: python-semantic-release/python-semantic-release@branch
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    git_committer_name: "Release Bot"
    git_committer_email: "bot@example.com"
    gpg_private_signing_key: ${{ secrets.GPG_PRIVATE }}
    gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}  # Optional

Verify signed commit: git verify-commit HEAD and git verify-tag v1.0.0

PR Completion Checklist

• Reviewed & followed the Contributor Guidelines

• Changes Implemented & Validation pipeline succeeds

• Commits follow the Conventional Commits standard
  and are separated into the proper commit type and scope (recommended order: test, build, feat/fix, docs)

• Appropriate Unit tests added/updated

• Appropriate End-to-End tests added/updated

• Appropriate Documentation added/updated and syntax validated for sphinx build (see Contributor Guidelines)

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.