Upload the IntelliJ plugin unsigned

The Marketplace signs every upload with the JetBrains key, and the check of the author's key
against the profile is not available yet, so a signature of our own buys nothing today. It can
come back with a signing block in the plugin's build script and three secrets when it is wanted.

Author: abashev

.github/workflows/release.yml

@@ -10,15 +10,13 @@ name: Release
 #
 # Once Maven Central serves both, the Gradle plugins go to the Gradle Plugin Portal, signed with the same
 # release key, and the IntelliJ plugin goes to the JetBrains Marketplace, verified against the IDEs it
-# supports and signed with a key of its own. After publishing, a draft GitHub release on the tag collects the
-# runnable jar, the Gradle and IDE plugins and the native binaries.
+# supports first. After publishing, a draft GitHub release on the tag collects the runnable jar, the Gradle
+# and IDE plugins and the native binaries.
 #
-# Needs ten repository secrets: JRELEASER_MAVENCENTRAL_USERNAME and JRELEASER_MAVENCENTRAL_PASSWORD (the
+# Needs seven repository secrets: JRELEASER_MAVENCENTRAL_USERNAME and JRELEASER_MAVENCENTRAL_PASSWORD (the
 # Central Portal user token), JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE, GRADLE_PUBLISH_KEY and
-# GRADLE_PUBLISH_SECRET (the Gradle Plugin Portal key), JETBRAINS_MARKETPLACE_TOKEN (a permanent token of
-# the Marketplace account that owns the plugin), and JETBRAINS_CERTIFICATE_CHAIN, JETBRAINS_PRIVATE_KEY and
-# JETBRAINS_PRIVATE_KEY_PASSWORD (the plugin signing key; without them the zip goes up unsigned). The draft
-# release uses the workflow's own GITHUB_TOKEN.
+# GRADLE_PUBLISH_SECRET (the Gradle Plugin Portal key) and JETBRAINS_MARKETPLACE_TOKEN (a permanent token of
+# the Marketplace account that owns the plugin). The draft release uses the workflow's own GITHUB_TOKEN.
 on:
   push:
     tags:
@@ -307,13 +305,10 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-      - name: Sign and upload the plugin
+      - name: Upload the plugin
         run: ./gradlew :open-java-format-idea-plugin:publishPlugin
         env:
           JETBRAINS_MARKETPLACE_TOKEN: ${{ secrets.JETBRAINS_MARKETPLACE_TOKEN }}
-          JETBRAINS_CERTIFICATE_CHAIN: ${{ secrets.JETBRAINS_CERTIFICATE_CHAIN }}
-          JETBRAINS_PRIVATE_KEY: ${{ secrets.JETBRAINS_PRIVATE_KEY }}
-          JETBRAINS_PRIVATE_KEY_PASSWORD: ${{ secrets.JETBRAINS_PRIVATE_KEY_PASSWORD }}
 
   # What Maven Central does not carry — the runnable formatter jar, the Gradle plugins' jar, the IntelliJ
   # plugin zip, the Eclipse plugin jar, and every platform's native binary as a plain download — goes into

mise.toml

@@ -86,11 +86,6 @@ apply GRADLE_PUBLISH_KEY 'op://Private/open-java-format/GitHub/GRADLE_PUBLISH_KE
 apply GRADLE_PUBLISH_SECRET 'op://Private/open-java-format/GitHub/GRADLE_PUBLISH_SECRET' actions
 
 # What release.yml uploads the IntelliJ plugin to the JetBrains Marketplace with: a permanent token of the
-# Marketplace account that owns the plugin, and the key the zip is signed with before the Marketplace adds
-# its own signature. The chain and the key are the PEM files as they are, line breaks included; the key
-# stays encrypted with the password.
+# Marketplace account that owns the plugin.
 apply JETBRAINS_MARKETPLACE_TOKEN 'op://Private/open-java-format/GitHub/JETBRAINS_MARKETPLACE_TOKEN' actions
-apply JETBRAINS_CERTIFICATE_CHAIN 'op://Private/open-java-format/GitHub/JETBRAINS_CERTIFICATE_CHAIN' actions
-apply JETBRAINS_PRIVATE_KEY 'op://Private/open-java-format/GitHub/JETBRAINS_PRIVATE_KEY' actions
-apply JETBRAINS_PRIVATE_KEY_PASSWORD 'op://Private/open-java-format/GitHub/JETBRAINS_PRIVATE_KEY_PASSWORD' actions
 """

open-java-format-idea-plugin/build.gradle

@@ -106,21 +106,12 @@ intellijPlatform {
     // publishPlugin uploads the zip to the JetBrains Marketplace, from the release workflow (see
     // .github/workflows/release.yml). The token is a permanent token of the Marketplace account that owns
     // the plugin; without it the task fails before uploading anything. The Marketplace never takes a version
-    // back and rejects a version it already has.
+    // back and rejects a version it already has. The zip goes up unsigned, and the Marketplace signs it with
+    // the JetBrains key; a signature of our own would take a `signing { }` block here and three more secrets.
     publishing {
         token = providers.environmentVariable('JETBRAINS_MARKETPLACE_TOKEN')
     }
 
-    // signPlugin runs before publishPlugin and signs the zip with this key, and the Marketplace then adds
-    // its own signature on top. Without the three variables signPlugin is skipped and the unsigned zip goes
-    // up, which the Marketplace accepts as well. The values are the PEM files themselves; the private key
-    // stays encrypted, and the password decrypts it.
-    signing {
-        certificateChain = providers.environmentVariable('JETBRAINS_CERTIFICATE_CHAIN')
-        privateKey = providers.environmentVariable('JETBRAINS_PRIVATE_KEY')
-        password = providers.environmentVariable('JETBRAINS_PRIVATE_KEY_PASSWORD')
-    }
-
     // verifyPlugin checks the plugin's bytecode against real IDEs, which it downloads. Two of them: the
     // IDE the plugin is built against, which is the oldest one sinceBuild admits, and the newest IntelliJ
     // IDEA release. The default, recommended(), would take every major version in between, which is a