What the developer wrote
Authored by Gustavo Stingelin Cardoso Filho
CI: add pgp keys expire check
What changed, and why it matters
This commit adds a new automated CI check that warns if the project's release signing PGP keys are about to expire. It does not change any application code, fix a bug, or alter how LND runs. It is purely a release-process safety improvement.
No action required; this is a defensive CI hardening change. Optionally verify that `scripts/check-pgp-expiry.sh` exists and is itself safe.
Security signals we found
Adds proactive CI check for PGP key expiration
Only affects release workflow; no runtime or application code changes
Evidence from the diff
The change adds a new GitHub Actions job named pgp-key-expiration-check to .github/workflows/release.yaml. The job runs scripts/check-pgp-expiry.sh on ubuntu-latest before the release build. No source code, cryptography, or network behavior of LND is modified.
Changed components
.github/workflows/release.yamlInspect captured patch +16 / −0
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 9158690..5d5d9f6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,6 +15,22 @@ env:
GO_VERSION: 1.23.12
jobs:
+ ########################
+ # Check release signing keys
+ ########################
+ pgp-key-expiration-check:
+ name: Check release signing key expirations
+ runs-on: ubuntu-latest
+ steps:
+ - name: Git checkout
+ uses: actions/checkout@v4
+
+ - name: Check PGP key expirations
+ run: scripts/check-pgp-expiry.sh
+
+ ########################
+ # Create release
+ ########################
main:
name: Release build
runs-on: ubuntu-latest
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.