wip: pass GPG passphrase to Maven in release workflow and docs

Author: simbo1905

.github/workflows/release-on-tag.yml

@@ -45,7 +45,7 @@ jobs:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
         run: |
-          mvn -B -ntp clean deploy
+          mvn -B -ntp -Dgpg.passphrase="${{ secrets.GPG_PASSPHRASE }}" clean deploy
 
       - name: Configure Git identity
         run: |

AGENTS.md

@@ -84,7 +84,7 @@ Automated Release (preferred)
 - Push a tag named `release/X.Y.Z` (semver, no leading `v`).
 - The workflow `.github/workflows/release-on-tag.yml` will:
   - Create a GitHub Release for that tag with autogenerated notes.
-  - Build and deploy artifacts to Maven Central (Central Publishing plugin).
+  - Build and deploy artifacts to Maven Central (Central Publishing plugin). Uses `-Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}` for signing.
   - Create a branch `release-bot-YYYYMMDD-HHMMSS` at the tagged commit and open a PR back to `main` (no version bumps).
 
 Manual Release (local)

RELEASE-GIST.md

@@ -39,7 +39,7 @@ jobs:
         env:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
-        run: mvn -B -ntp clean deploy
+        run: mvn -B -ntp -Dgpg.passphrase="${{ secrets.GPG_PASSPHRASE }}" clean deploy
       - name: Configure Git identity
         run: |
           git config user.name "github-actions[bot]"