Default gpg-passphrase to MAVEN_GPG_PASSPHRASE

Align the default `gpg-passphrase` input value with the maven-gpg-plugin default environment variable name (MAVEN_GPG_PASSPHRASE). With this default, setup-java writes no extra GPG configuration to settings.xml and the plugin reads the passphrase from MAVEN_GPG_PASSPHRASE out of the box. Also document that reading the passphrase from an environment variable via `gpg.passphraseEnvName` requires maven-gpg-plugin 3.2.0 or newer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1
brunoborges · Jul 15, 2026 · Jul 15, 2026 · Jul 15, 2026 · Jul 15, 2026 · Jul 15, 2026
commit 4dbb381e91d9a7627fc62e9a568c422c8b438bdb
@@ -70,7 +70,7 @@ For more details,  see the full release notes on the [releases page](https://git
 
   - `gpg-private-key`: GPG private key to import. Default is empty string.
 
-  - `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is GPG_PASSPHRASE.
+  - `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is MAVEN_GPG_PASSPHRASE.
 
   - `mvn-toolchain-id`: Name of Maven Toolchain ID if the default name of `${distribution}_${java-version}` is not wanted.
 

diff --git a/action.yml b/action.yml
@@ -68,7 +68,7 @@ inputs:
     required: false
     default: ''
   gpg-passphrase:
-    description: 'Environment variable name for the GPG private key passphrase. Defaults to GPG_PASSPHRASE when gpg-private-key is set; ignored otherwise.'
+    description: 'Environment variable name for the GPG private key passphrase. Defaults to MAVEN_GPG_PASSPHRASE when gpg-private-key is set; ignored otherwise.'
     required: false
   cache:
     description: 'Name of the build platform to cache dependencies. It can be "maven", "gradle" or "sbt".'

@@ -95848,7 +95848,7 @@ const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings';
 const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
 const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
 const INPUT_DEFAULT_GPG_PRIVATE_KEY = (/* unused pure expression or super */ null && (undefined));
-const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
+const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE';
 // The default name of the environment variable the maven-gpg-plugin reads the
 // passphrase from (property `gpg.passphraseEnvName`). When the configured
 // passphrase env var name matches this, no extra configuration is required.

@@ -73293,7 +73293,7 @@ const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings';
 const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
 const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
 const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined;
-const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
+const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE';
 // The default name of the environment variable the maven-gpg-plugin reads the
 // passphrase from (property `gpg.passphraseEnvName`). When the configured
 // passphrase env var name matches this, no extra configuration is required.

@@ -682,10 +682,10 @@ If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the `
         MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
 ```
 
-The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). The [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/) reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property, which defaults to `MAVEN_GPG_PASSPHRASE`.
+The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). It defaults to `MAVEN_GPG_PASSPHRASE`, matching the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/), which reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property (default `MAVEN_GPG_PASSPHRASE`).
 
-- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE`, the plugin already reads that variable by default, so setup-java writes nothing extra to `settings.xml`.
-- If `gpg-passphrase` is any other name, setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable:
+- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE` (the default), the plugin already reads that variable, so setup-java writes nothing extra to `settings.xml`.
+- If `gpg-passphrase` is any other name, setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable. For example, with `gpg-passphrase: GPG_PASSPHRASE`:
 
 ```xml
     <profiles>
@@ -703,6 +703,8 @@ The `gpg-passphrase` input is the **name of the environment variable** that hold
 
 > **Note:** Earlier versions of setup-java wrote a `gpg.passphrase` server to `settings.xml`. That mechanism is deprecated by the Maven GPG Plugin and fails when its `bestPractices` mode is enabled, so setup-java now relies on `gpg.passphraseEnvName` instead.
 
+> **Compatibility note:** Reading the passphrase from an environment variable (`gpg.passphraseEnvName`, default `MAVEN_GPG_PASSPHRASE`) requires `maven-gpg-plugin` 3.2.0 or newer. Older versions do not honor this property and will not pick up the passphrase, because setup-java no longer writes the deprecated `gpg.passphrase` server to `settings.xml`. If you are pinned to `maven-gpg-plugin` older than 3.2.0, upgrade to 3.2.0+ (recommended) or supply the passphrase through a mechanism supported by your plugin version.
+
 When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
 
 ```xml

@@ -19,7 +19,7 @@ export const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
 export const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
 
 export const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined;
-export const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
+export const INPUT_DEFAULT_GPG_PASSPHRASE = 'MAVEN_GPG_PASSPHRASE';
 
 // The default name of the environment variable the maven-gpg-plugin reads the
 // passphrase from (property `gpg.passphraseEnvName`). When the configured