From 29baef6c9066443e280da61a61781fa3a445f564 Mon Sep 17 00:00:00 2001
From: loginradius-sdk-bot <sdk-bot@loginradius.com>
Date: Tue, 22 Sep 2026 15:20:41 +0530
Subject: [PATCH] chore(sdk): sync Java SDK v12.0.0-rc.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generated output — do not edit this repository by hand; change
the source and re-sync, or the next run will overwrite it.

sdk version:       12.0.0-rc.1
generator:         v7.10.0
spec:              LoginRadius-Public-APIs.yaml
---
 .github/workflows/release.yml | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a990e67..9c6019b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,15 +67,42 @@ jobs:
           java-version: '17'
           cache: maven
           # Writes a settings.xml whose <server> id matches
-          # <publishingServerId>central</publishingServerId> in the pom, and
-          # imports the signing key. The values below are ENV VAR NAMES, not
-          # the secrets themselves — that is this action's contract.
+          # <publishingServerId>central</publishingServerId> in the pom. The
+          # values below are ENV VAR NAMES, not the secrets themselves — that
+          # is this action's contract.
+          #
+          # gpg-private-key is deliberately NOT set here. setup-java pipes that
+          # value straight into `gpg --import`, which accepts an ASCII-armored
+          # export and nothing else; a base64-encoded secret fails with a bare
+          # "The process '/usr/bin/gpg' failed with exit code 2". The key is
+          # imported by the step below instead, which takes either form — the
+          # same one the pre-factory workflow used, so an existing secret keeps
+          # working untouched.
           server-id: central
           server-username: MAVEN_USERNAME
           server-password: MAVEN_CENTRAL_TOKEN
-          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
+      # Pinned to a commit, not a tag: a tag on a third-party action can be
+      # repointed at any time, and this step is handed the signing key.
+      # e89d4093 is v6.3.0.
+      - name: Import the signing key
+        uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec
+        with:
+          gpg_private_key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+
+      # Prove a SECRET key actually landed in the keyring. Importing a public
+      # key succeeds quietly and then fails much later with "no secret key",
+      # by which point the run has done real work.
+      - name: Verify the key is usable for signing
+        run: |
+          if [ "$(gpg --list-secret-keys 2>/dev/null | grep -c '^sec')" -eq 0 ]; then
+            echo "::error::no secret key in the keyring — MAVEN_GPG_PRIVATE_KEY is not a private key export"
+            exit 1
+          fi
+          gpg --list-secret-keys --keyid-format=long | grep '^sec'
+
       # The pom <version>, the tag and the generated SDK version are three
       # independent facts until something compares them.
       - name: Tag matches the pom and the SDK version