fix(ci): preset GPG passphrase for non-interactive signing

- Configure gpg-agent with allow-preset-passphrase
- Preset GPG_PASSPHRASE for all secret keygrips after import
- Add GPG_PASSPHRASE secret to release workflow env

Author: bodji

.github/workflows/release.yaml

@@ -72,6 +72,7 @@ jobs:
       if: github.event_name == 'release'
       env:
         GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
       run: releaser/apt_release.sh ${GITHUB_REF#refs/tags/}
 
     - name: Upload artifacts to release

releaser/apt_release.sh

@@ -136,9 +136,19 @@ if [[ -n "$GPG_PRIVATE_KEY" ]]; then
   echo " Using GPG key: $GPG_KEY_ID"
 
   # Configure gpg-agent for non-interactive signing in CI
+  # GPG 2.x always protects keys via the agent — preset the passphrase so signing doesn't prompt
   mkdir -p ~/.gnupg
-  echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
+  chmod 700 ~/.gnupg
+  cat > ~/.gnupg/gpg-agent.conf <<AGENTCONF
+allow-loopback-pinentry
+allow-preset-passphrase
+AGENTCONF
   gpg-connect-agent reloadagent /bye 2>/dev/null || true
+
+  # Preset passphrase for every secret subkey keygrip
+  for KEYGRIP in $(gpg --list-secret-keys --with-keygrip --with-colons 2>/dev/null | awk -F: '/^grp/{print $10}'); do
+    /usr/lib/gnupg/gpg-preset-passphrase --preset --passphrase "$GPG_PASSPHRASE" "$KEYGRIP"
+  done
 else
   if [[ "$DRY_RUN" != "true" ]]; then
     echo "Error: GPG_PRIVATE_KEY is required for signing (set DRY_RUN=true to skip)"
@@ -218,14 +228,14 @@ cd -
 # GPG sign the Release file
 if [[ -n "$GPG_KEY_ID" ]]; then
   # Detached signature
-  echo | gpg --batch --yes --armor --pinentry-mode loopback --passphrase-fd 0 \
+  gpg --batch --yes --armor \
     --default-key "$GPG_KEY_ID" \
     --detach-sign \
     --output "$APT_DIR/dists/stable/Release.gpg" \
     "$APT_DIR/dists/stable/Release"
 
   # Inline signature (InRelease)
-  echo | gpg --batch --yes --armor --pinentry-mode loopback --passphrase-fd 0 \
+  gpg --batch --yes --armor \
     --default-key "$GPG_KEY_ID" \
     --clearsign \
     --output "$APT_DIR/dists/stable/InRelease" \