Document both file-based and in-memory GPG signing for publishing

[Copilot]

The PUBLISHING.md documentation showed inconsistency between GPG Key Setup (file-based secretKeyRingFile) and CI/CD Integration (in-memory signingKey).

Changes

• GPG Key Setup: Split into file-based (traditional) and in-memory (CI/CD) subsections with export instructions for each approach
• Configure Credentials: Restructured as Option A (file-based for local) and Option B (in-memory for CI/CD) with complete environment variable examples
• CI/CD Setup: Explicitly recommend in-memory signing, clarify required GitHub secrets, add note on avoiding temporary key files on runners

Both approaches now documented with clear use cases:

# File-based (local development)
signing.secretKeyRingFile=/path/to/.gnupg/secring.gpg

# In-memory (CI/CD)
export ORG_GRADLE_PROJECT_signingKey="$(cat private-key.asc)"

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR enhances the PUBLISHING.md documentation by clearly differentiating between file-based and in-memory GPG signing approaches, addressing previous inconsistencies in the documentation. The changes provide comprehensive guidance for both local development (file-based) and CI/CD environments (in-memory signing).

Key Changes:

• Split GPG Key Setup into file-based (traditional) and in-memory (CI/CD) subsections with specific export instructions for each
• Restructured environment variable configuration with clear examples for both in-memory and file-based approaches
• Enhanced CI/CD section to explicitly recommend in-memory signing and clarify required GitHub secrets

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Missing opening code fence. The code block needs to start with three backticks (```) before the bash commands to properly format the code block.

[Copilot]

The section title "Alternatively, for file-based signing in CI/CD:" is misleading. Looking at lines 114-118, this section actually shows the in-memory signing approach (using signingKey with GPG_PRIVATE_KEY_SECRET), not file-based signing. The only file-based option shown is the "Alternative" on line 123 which uses signingSecretKeyRingFile. Consider revising this section title to accurately reflect that it shows an alternative way to provide the in-memory key (from a secret variable) versus the recommended approach on line 108 which reads from a file.

[Copilot]

The statement "The base64-encoded key from GPG_SIGNING_KEY is decoded automatically by Gradle" is inaccurate. According to the earlier documentation (line 234), GPG_SIGNING_KEY should contain the ASCII-armored private key from "gpg --armor --export-secret-keys", not a base64-encoded key. ASCII-armored format is already a base64-like encoding but in PGP's specific format. Gradle's signing plugin expects the ASCII-armored format directly, not an additional base64 encoding. This note should be corrected to avoid confusion about the expected key format.