Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server

[brunoborges]

Description:

The maven-gpg-plugin's gpg.passphrase / passphraseServerId mechanism (a <server id="gpg.passphrase"> entry in settings.xml) is deprecated, and it fails outright once the plugin's bestPractices mode is enabled. This PR switches setup-java to the plugin's recommended gpg.passphraseEnvName mechanism.

Approach:

• generate() in src/auth.ts no longer writes the gpg.passphrase server to settings.xml.
• The gpg-passphrase input is the name of the environment variable holding the passphrase, and its default is unchanged (GPG_PASSPHRASE), so existing workflows that already set that variable keep working.
• setup-java sets gpg.passphraseEnvName through an active profile in the generated settings.xml so the plugin reads the passphrase from the configured variable. When the name equals the plugin default MAVEN_GPG_PASSPHRASE, nothing extra is written because the plugin already reads it.

Compatibility:

• The env var name and default are preserved, so this is not a breaking change for workflows on maven-gpg-plugin 3.2.0+.
• Reading the passphrase from an environment variable (gpg.passphraseEnvName) requires maven-gpg-plugin 3.2.0 or newer. Older versions do not honor this property, and since the deprecated gpg.passphrase server is no longer written, they will not pick up the passphrase. Users pinned to older plugins should upgrade to 3.2.0+. This is called out under "Breaking changes in V6" in the README and documented in docs/advanced-usage.md.

Docs (README.md, docs/advanced-usage.md) were updated to describe the new mechanism and the version requirement. The e2e-publishing.yml settings.xml validation was updated to assert the new generated output.

Related issue:

Fixes: #760

Check list:

• Ran npm run check locally (format, lint, build, test) and all checks pass.
• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

[Copilot]

Pull request overview

Updates actions/setup-java Maven settings.xml generation to stop using the deprecated gpg.passphrase server mechanism and instead configure the Maven GPG Plugin via gpg.passphraseEnvName (only when the configured env var name differs from the plugin default MAVEN_GPG_PASSPHRASE). This aligns setup-java with the Maven GPG Plugin’s recommended configuration and avoids failures when bestPractices is enabled.

Changes:

• Add constants for the Maven GPG Plugin default passphrase env var name and a dedicated settings profile id.
• Update src/auth.ts to write an active settings.xml profile that sets gpg.passphraseEnvName instead of writing a gpg.passphrase server.
• Update docs and tests to reflect the new mechanism (and regenerate dist/ output).

Show a summary per file

File	Description
src/constants.ts	Introduces constants for Maven GPG Plugin default env var name and settings profile id.
src/auth.ts	Switches from writing gpg.passphrase server to writing an active profile that sets gpg.passphraseEnvName when needed.
docs/advanced-usage.md	Updates guidance and examples to describe the gpg.passphraseEnvName approach and deprecation of the old server mechanism.
tests/auth.test.ts	Updates/extends settings.xml generation assertions for the new profile-based behavior (including the “plugin default env var” case).
dist/setup/index.js	Regenerated distribution output reflecting the updated settings.xml generation behavior.
dist/cleanup/index.js	Regenerated distribution output reflecting updated constants.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/7 changed files
• Comments generated: 1
• Review effort level: Low