Pass signing key via env so its value is never echoed in CI logs

2026-09-20 22:21:25 +02:00
parent 19e19281de
commit 642cc36a39
1 changed files with 5 additions and 1 deletions
@@ -80,8 +80,12 @@ jobs:
            -o gpu-turnstile.exe ./cmd/gpu-turnstile

      - name: Sign and checksum
+        env:
+          RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
        run: |
-          printf '%s\n' "${{ secrets.RELEASE_SIGNING_KEY }}" > key.pem
+          # The key comes via the environment so its value never appears in
+          # the echoed command line of the run log.
+          printf '%s\n' "$RELEASE_SIGNING_KEY" > key.pem
          chmod 600 key.pem
          openssl pkeyutl -sign -inkey key.pem -rawin \
            -in gpu-turnstile.exe -out gpu-turnstile.exe.sig