From b1c857b8dfb7e8c3458665a28d0e4d85b7e5dbfb Mon Sep 17 00:00:00 2001
From: Liam DeVoe <orionldevoe@gmail.com>
Date: Fri, 12 Jun 2026 09:59:33 -0400
Subject: [PATCH] claude: silence GPG passphrase-decryption stacktrace in
 release logs

---
 pom.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pom.xml b/pom.xml
index 699cde1..90b2553 100644
--- a/pom.xml
+++ b/pom.xml
@@ -304,6 +304,15 @@
                   <goal>sign</goal>
                 </goals>
                 <configuration>
+                  <!-- Never read a passphrase from settings.xml. Our release key has no
+                       passphrase, but actions/setup-java templates a gpg.passphrase server
+                       entry into the runner's settings.xml whenever gpg-private-key is
+                       supplied (even with no gpg-passphrase input), and resolving it dumps
+                       a harmless-but-noisy SecDispatcherException stacktrace (no
+                       ~/.m2/settings-security.xml) into the release logs. If the key ever
+                       gains a passphrase, supply it via the MAVEN_GPG_PASSPHRASE
+                       environment variable. -->
+                  <bestPractices>true</bestPractices>
                   <gpgArguments>
                     <!--  don't ask for passphrase. might not be required-->
                     <arg>--pinentry-mode</arg>