From 642cc36a39f7b058aefa0a1fba60bcd275e151b1 Mon Sep 17 00:00:00 2001
From: mram <mram@rambossek.at>
Date: Sun, 20 Sep 2026 22:21:25 +0200
Subject: [PATCH] Pass signing key via env so its value is never echoed in CI
 logs

---
 .gitea/workflows/ci.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f5d7df7..bab4fa2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -80,8 +80,12 @@ jobs:
             -o gpu-turnstile.exe ./cmd/gpu-turnstile
 
       - name: Sign and checksum
+        env:
+          RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
         run: |
-          printf '%s\n' "${{ secrets.RELEASE_SIGNING_KEY }}" > key.pem
+          # The key comes via the environment so its value never appears in
+          # the echoed command line of the run log.
+          printf '%s\n' "$RELEASE_SIGNING_KEY" > key.pem
           chmod 600 key.pem
           openssl pkeyutl -sign -inkey key.pem -rawin \
             -in gpu-turnstile.exe -out gpu-turnstile.exe.sig