From 7e14bd3c5d154b1f2796599d5c6985cb6f0d8dd5 Mon Sep 17 00:00:00 2001
From: "ark-hand[bot]" <315378070+ark-hand[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 10:24:44 +0000
Subject: [PATCH] probe: verify release secrets

---
 .github/workflows/probe-secrets.yml | 50 +++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 .github/workflows/probe-secrets.yml

diff --git a/.github/workflows/probe-secrets.yml b/.github/workflows/probe-secrets.yml
new file mode 100644
index 0000000..52b05c8
--- /dev/null
+++ b/.github/workflows/probe-secrets.yml
@@ -0,0 +1,50 @@
+name: Secrets Probe
+on:
+  push:
+    branches:
+      - "probe/**"
+permissions:
+  contents: read
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Secret presence
+        env:
+          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        run: |
+          missing=""
+          [ -z "$OSSRH_USERNAME" ] && missing="$missing OSSRH_USERNAME"
+          [ -z "$OSSRH_TOKEN" ] && missing="$missing OSSRH_TOKEN"
+          [ -z "$GPG_PRIVATE_KEY" ] && missing="$missing GPG_PRIVATE_KEY"
+          [ -z "$GPG_PASSPHRASE" ] && missing="$missing GPG_PASSPHRASE"
+          if [ -n "$missing" ]; then
+            echo "::error::missing secrets:$missing"
+            exit 1
+          fi
+          echo "all 4 secrets present"
+      - name: GPG key import and sign test
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        run: |
+          echo "$GPG_PRIVATE_KEY" | gpg --batch --import 2>&1 | tail -2
+          fpr=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr/{print $10; exit}')
+          echo "imported key fingerprint: $fpr"
+          echo probe > /tmp/probe.txt
+          gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --clearsign /tmp/probe.txt
+          echo "GPG sign with passphrase OK"
+      - name: Central token auth check
+        env:
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          MAVEN_CENTRAL_TOKEN: ${{ secrets.OSSRH_TOKEN }}
+        run: |
+          code=$(curl -sS -o /tmp/central.json -w '%{http_code}' -u "$MAVEN_CENTRAL_USERNAME:$MAVEN_CENTRAL_TOKEN" https://central.sonatype.com/api/v1/user)
+          echo "central.sonatype.com /api/v1/user -> HTTP $code"
+          python3 -c "import json;d=json.load(open('/tmp/central.json'));print('account:', d.get('name') or d.get('email') or '?')" 2>/dev/null || true
+          code2=$(curl -sS -o /dev/null -w '%{http_code}' -u "$MAVEN_CENTRAL_USERNAME:$MAVEN_CENTRAL_TOKEN" https://ossrh-staging-api.central.sonatype.com/service/local/staging/profiles)
+          echo "ossrh-staging-api /staging/profiles -> HTTP $code2"