From b802485e31ce1db07f09bd35343cabd9e0168970 Mon Sep 17 00:00:00 2001
From: The412Banner <the412banner@users.noreply.github.com>
Date: Thu, 24 Sep 2026 13:24:47 -0400
Subject: [PATCH] CI: the key alias is plain text, not a secret

---
 .github/workflows/sign.yml        | 3 ++-
 tools/release/make-release-key.sh | 1 -
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sign.yml b/.github/workflows/sign.yml
index ae70270fc..73d92b3e0 100644
--- a/.github/workflows/sign.yml
+++ b/.github/workflows/sign.yml
@@ -68,7 +68,8 @@ jobs:
         env:
           RELEASE_KEYSTORE_B64: ${{ secrets.RELEASE_KEYSTORE_B64 }}
           RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
-          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
+          # The alias is not a secret (and as one, GitHub would mask 'droiddeck' all over the logs).
+          RELEASE_KEY_ALIAS: droiddeck
           ENVIRONMENT: ${{ inputs.environment }}
           VARIANT: ${{ matrix.variant }}
           LABEL: ${{ inputs.label }}
diff --git a/tools/release/make-release-key.sh b/tools/release/make-release-key.sh
index 00f8eb48f..96d423ae1 100755
--- a/tools/release/make-release-key.sh
+++ b/tools/release/make-release-key.sh
@@ -49,7 +49,6 @@ SHA=$(awk '/SHA256:/ { print $2 }' <<<"$listing" | head -n1 | tr -d ':' | tr 'A-
 for env in "${ENVIRONMENTS[@]}"; do
   base64 -w0 < "$KS" | gh secret set RELEASE_KEYSTORE_B64 --env "$env" -R "$REPO" >/dev/null
   printf '%s' "$KS_PW" | gh secret set RELEASE_STORE_PASSWORD --env "$env" -R "$REPO" >/dev/null
-  printf '%s' "$ALIAS" | gh secret set RELEASE_KEY_ALIAS --env "$env" -R "$REPO" >/dev/null
   echo "secrets set for environment: $env"
 done
 unset KS_PW