From 84c1b38d53b2ca775fd5eda54e974c8861344e40 Mon Sep 17 00:00:00 2001
From: Igor Pecovnik <igor@armbian.com>
Date: Sat, 22 Aug 2026 13:11:12 +0200
Subject: [PATCH] action: sign every image format, not only .img.xz

The Sign step globbed build/output/images/*.img*.xz. That is the classic
compressed raw image and nothing else, so a build using image-output-iso (.iso)
or image-output-qcow2 (uncompressed .img.qcow2) matched nothing, gpg was handed
the literal pattern and the job died:

  gpg: can't open 'build/output/images/*.img*.xz': No such file or directory
  gpg: signing failed: No such file or directory

That is every cell of the SDK build, which uses exactly those two extensions.

Collect the artifacts with find (*.img*.xz, *.iso, *.qcow2), sign each one
separately - --detach-sign takes a single input, and this way each artifact gets
its own .asc - and fail with a directory listing when there is nothing to sign,
instead of letting gpg report a missing file that was never a file.

The passphrase moves to env rather than being interpolated into the script.

Signed-off-by: Igor Pecovnik <igor@armbian.com>
---
 action.yml | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/action.yml b/action.yml
index 0e79264e44..07999f145f 100644
--- a/action.yml
+++ b/action.yml
@@ -246,10 +246,32 @@ runs:
     - name: Sign
       shell: bash
       if: ${{ inputs.armbian_pgp_password != '' }}
+      env:
+        ARMBIAN_PGP_PASSWORD: ${{ inputs.armbian_pgp_password }}
       run: |
-        printf '%s' "${{ inputs.armbian_pgp_password }}" | \
-        gpg --passphrase-fd 0 --armor --detach-sign --pinentry-mode loopback --batch --yes \
-        build/output/images/*.img*.xz
+        set -euo pipefail
+
+        # Sign whatever the build actually produced. The glob used to be
+        # *.img*.xz, which is only the classic compressed raw image: an
+        # image-output-iso build emits a .iso and image-output-qcow2 emits an
+        # uncompressed .img.qcow2, so the glob matched nothing, gpg received the
+        # literal pattern and the job died with "can't open ... No such file".
+        mapfile -t images < <(find build/output/images -maxdepth 1 -type f \
+          \( -name '*.img*.xz' -o -name '*.iso' -o -name '*.qcow2' \) | sort)
+
+        if [[ ${#images[@]} -eq 0 ]]; then
+          echo "::error::Sign: no image artifacts found in build/output/images"
+          ls -la build/output/images || true
+          exit 1
+        fi
+
+        # One gpg call per file: --detach-sign takes a single input, and this
+        # way each artifact gets its own .asc.
+        for image in "${images[@]}"; do
+          echo "Signing $(basename "${image}")"
+          printf '%s' "${ARMBIAN_PGP_PASSWORD}" | \
+            gpg --passphrase-fd 0 --armor --detach-sign --pinentry-mode loopback --batch --yes "${image}"
+        done
 
     - name: "Generate release assets manifest"
       shell: bash