From e20df4ca22bf70010d3153aa3271865518763537 Mon Sep 17 00:00:00 2001
From: Ludy87 <Ludy87@users.noreply.github.com>
Date: Tue, 2 Dec 2025 14:47:23 +0100
Subject: [PATCH] Automate GPG key cleanup in AppImage build

Adds steps to export the GPG fingerprint to the environment and clean up the temporary GPG key after building the AppImage on Ubuntu. Also fixes heredoc usage for key generation parameters.
---
 .github/workflows/multiOSReleases.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml
index 89f56158a1..0625cf90d2 100644
--- a/.github/workflows/multiOSReleases.yml
+++ b/.github/workflows/multiOSReleases.yml
@@ -440,7 +440,7 @@ jobs:
       - name: Generate temporary GPG key for AppImage
         if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
         run: |
-          cat >keyparams <<'EOF'
+          cat >keyparams <<EOF
           %no-protection
           Key-Type: RSA
           Key-Length: 2048
@@ -450,6 +450,8 @@ jobs:
           %commit
           EOF
           gpg --batch --generate-key keyparams
+          export GPG_FINGERPRINT=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/ {print $10; exit}')
+          echo "GPG_FINGERPRINT=$GPG_FINGERPRINT" >> $GITHUB_ENV
           echo "Generated temporary GPG key:"
           gpg --list-secret-keys --keyid-format=long
 
@@ -476,6 +478,15 @@ jobs:
           tauriScript: npx tauri
           args: ${{ matrix.args }}
 
+      - name: Cleanup temporary GPG key
+        if: matrix.platform == 'ubuntu-22.04' && matrix.name == 'linux-x86_64-appimage'
+        run: |
+          if [ -n "${GPG_FINGERPRINT:-}" ]; then
+            gpg --batch --yes --delete-secret-keys "$GPG_FINGERPRINT" || true
+            gpg --batch --yes --delete-keys "$GPG_FINGERPRINT" || true
+          fi
+          rm -f keyparams
+
       # Sign with DigiCert KeyLocker (post-build)
       - name: Sign Windows binaries with DigiCert KeyLocker
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}