Repository navigation
Import the GPG key with plain gpg, not a third-party action crazy-max/ghaction-import-gpg was handed the private key material directly; replace it with a two-line gpg --batch --import, which does the same job using only the runner's built-in gpg, no external action in the trust chain for the signing key. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>