github actions: move pgp key to daily builds
What the developer wrote
Authored by ziggie
github actions: move pgp key to daily builds
What changed, and why it matters
This commit moves a daily check of PGP key expiration from the release workflow to the daily Docker build workflow. It is a routine CI/CD housekeeping change. It does not fix a vulnerability, change cryptographic code, or alter how releases are signed. The change makes the check run more frequently and allows it to fail without blocking a release.
No security action required. Treat as normal CI maintenance. Optionally verify that `scripts/check-pgp-expiry.sh` still alerts maintainers effectively after the workflow move.
Security signals we found
PGP key expiration monitoring is relocated but not removed
New job uses continue-on-error, reducing operational risk of false-positive build failures
No changes to signing keys, release artifacts, or cryptographic verification
Evidence from the diff
The commit removes the pgp-key-expiration-check job from .github/workflows/release.yaml and adds an equivalent pgp-key-check job to .github/workflows/docker.yml. The new job adds continue-on-error: true, meaning expiration warnings will not fail the daily build. The script scripts/check-pgp-expiry.sh is unchanged and still checks release signing key expirations. No application code, signing logic, or key material is modified.
Changed components
.github/workflows/docker.yml.github/workflows/release.yamlInspect captured patch +20 / −13
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index b6e763d..a9bb6cb 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -17,6 +17,26 @@ env:
DOCKER_IMAGE: lnd
jobs:
+ ########################
+ # Check release signing keys
+ ########################
+ pgp-key-check:
+ name: Check PGP key expirations
+ runs-on: ubuntu-latest
+ # We don't want to fail the build because of PGP key expirations because
+ # they are only used for release builds and this job failing should catch
+ # the attention of the maintainers.
+ continue-on-error: true
+ steps:
+ - name: Git checkout
+ uses: actions/checkout@v4
+
+ - name: Check PGP key expirations
+ run: scripts/check-pgp-expiry.sh
+
+ ########################
+ # Build and push the daily docker image
+ ########################
main:
runs-on: ubuntu-latest
steps:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5d5d9f6..931edc6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,19 +15,6 @@ env:
GO_VERSION: 1.23.12
jobs:
- ########################
- # Check release signing keys
- ########################
- pgp-key-expiration-check:
- name: Check release signing key expirations
- runs-on: ubuntu-latest
- steps:
- - name: Git checkout
- uses: actions/checkout@v4
-
- - name: Check PGP key expirations
- run: scripts/check-pgp-expiry.sh
-
########################
# Create release
########################
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.