From a0ecc255673272a47414daad8c6898cf1fde4c0f Mon Sep 17 00:00:00 2001 From: Lior Poterman <191881919+cx-lior-poterman@users.noreply.github.com> Date: Thu, 24 Sep 2026 10:20:21 +0300 Subject: [PATCH] fix(ci): export AWS secrets without name prefix in release workflow The GPG signing step in the Maven release job resolves its key and credentials to empty because the AWS secrets-manager fetch step exports each secret key prefixed with a sanitized version of the secret name, while downstream steps read the plain, unprefixed env var names. Adding a leading blank alias to the secret-ids list makes the action export the keys unprefixed, matching what the rest of the workflow already expects. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9289323..7e9ba51 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -89,7 +89,7 @@ jobs: uses: step-security/aws-secretsmanager-get-secrets@102b6b2a2528747bcc321bb99ef326d8be7ef58f # v3.0.1 with: secret-ids: | - ${{ secrets.SECRET_MANAGER_SECRET_NAME }} + ,${{ secrets.SECRET_MANAGER_SECRET_NAME }} parse-json-secrets: true - name: Download CLI