From 35cc075adc7ea68f869265ec16d7427022a03777 Mon Sep 17 00:00:00 2001
From: nopeitsnothing <no@anonymousplanet.net>
Date: Sat, 27 Jun 2026 21:18:16 -0400
Subject: [PATCH] chore: bump actions/checkout@v7 Do a sparse checkout on given
 patterns. Each pattern should be separated with new lines

Signed-off-by: nopeitsnothing <no@anonymousplanet.net>
---
 .github/workflows/01-build.yml     |  2 +-
 .github/workflows/02-sign.yml      | 11 +++++++----
 .github/workflows/03-release.yml   |  3 ++-
 .github/workflows/04-changelog.yml |  2 +-
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/01-build.yml b/.github/workflows/01-build.yml
index a99fbe8..17211c0 100644
--- a/.github/workflows/01-build.yml
+++ b/.github/workflows/01-build.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: 🛠️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: 🐍 Set up Python
         uses: actions/setup-python@v5
diff --git a/.github/workflows/02-sign.yml b/.github/workflows/02-sign.yml
index 189d6ed..920079c 100644
--- a/.github/workflows/02-sign.yml
+++ b/.github/workflows/02-sign.yml
@@ -29,9 +29,10 @@ jobs:
 
     steps:
       - name: 🛠️ Checkout (for pgp/ key reference only)
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           sparse-checkout: pgp
+          sparse-checkout-cone-mode: true
 
       - name: 📥 Download PDF artifacts
         uses: actions/download-artifact@v4
@@ -110,7 +111,7 @@ jobs:
 
       # Commit export/ back to main
       - name: 📦 Checkout full repo for commit
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: main
           fetch-depth: 0
@@ -120,6 +121,8 @@ jobs:
         run: cp -v export/* repo/export/
 
       - name: 🔏 Configure GPG commit signing
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
         run: |
           mkdir -p ~/.gnupg
           echo "$GPG_PRIVATE_KEY" | gpg --batch --quiet --import > /dev/null 2>&1 || true
@@ -182,10 +185,10 @@ jobs:
     needs: sign
     # Always run so the summary is visible even if sign partially failed
     if: always()
-
+    # Do a sparse checkout on given patterns. Each pattern should be separated with new lines
     steps:
       - name: 🛠️ Checkout scripts and public key
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           sparse-checkout: |
             scripts/verify_pdf.py
diff --git a/.github/workflows/03-release.yml b/.github/workflows/03-release.yml
index d8768e9..657ecd8 100644
--- a/.github/workflows/03-release.yml
+++ b/.github/workflows/03-release.yml
@@ -31,10 +31,11 @@ jobs:
 
     steps:
       - name: 🛠️ Checkout (for pgp/)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           sparse-checkout: pgp
+          sparse-checkout-cone-mode: true
 
       # Download artifacts from the specified sign run
       - name: 📥 Download signatures artifact
diff --git a/.github/workflows/04-changelog.yml b/.github/workflows/04-changelog.yml
index 683d7f7..3b01c7d 100644
--- a/.github/workflows/04-changelog.yml
+++ b/.github/workflows/04-changelog.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: 🛠️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Use a PAT so the commit triggers downstream workflows (GITHUB_TOKEN won't)
           token: ${{ secrets.CHANGELOG_PAT || secrets.GITHUB_TOKEN }}