check / check (push) Waiting to run
getDefaultGPGKey took the default-key value from `gpgconf --list-options gpg` as printed. gpgconf prints a string value with a leading `"` and percent-escaped, so gpg rejected the key ID. The parsing moved into parseDefaultGPGKey, which drops the `"` and percent-decodes the rest with url.PathUnescape, which leaves `+` alone. A value that does not decode is an error, not a fallback to the first secret key. Rule suppressed: gosec G703 on the test's write of gpg.conf into the GNUPGHOME directory newTestGPGKey made. Model: opus-5-5