Nice work — this matches how I'd approach #1211 almost exactly (isolated home, 0600 key file with wx, no fingerprint parsing, state-driven cleanup, saveState before exportVariable with rollback). Two things I ran into implementing the same fix that might be worth folding in:

1. gpg-agent outlives the home

removeGpgHome goes straight to io.rmRF. Importing a secret key starts a gpg-agent bound to that --homedir. Two consequences:

• the agent can outlive the job with key material still cached, which is the exact leak class the issue is about on persistent self-hosted runners;
• on Windows the agent holds open handles under the home, so rmRF can fail — and since removeGpgHome failure calls setFailed, that turns into a red job at the end of an otherwise green run.

Best-effort kill before removal handles both:

try {
  await exec.exec(
    'gpgconf',
    ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'],
    {silent: true, ignoreReturnCode: true}
  );
} catch {
  // gpgconf may not be present; removal is still attempted
}

await io.rmRF(resolvedGpgHome);

2. GNUPGHOME value on Windows

auth.ts exports the native path, while the action's own gpg invocations use toGpgPath(gpgHome) for --homedir. That asymmetry may be deliberate, but it's worth pinning down: GNUPGHOME is read by whichever gpg the user's Maven ends up invoking, and the MSYS2/Git-bundled gpg on the Windows runners and native Gpg4win don't interpret /d/a/_temp/... vs D:\a\_temp\... the same way. I don't think either choice is safe to assume without an actual Windows run exercising a real signing step against both — has that been tested end to end on windows-latest?

The removeGpgHome ownership guard (dirname === temp && basename.startsWith(prefix)) is a good call — I'd adopted the same idea after noticing that cleanup otherwise rmRFs whatever the state value happens to contain.

Addressed both cleanup follow-ups in 53f7386: removeGpgHome now best-effort kills the isolated home’s gpg-agent via gpgconf before deletion (while still deleting if gpgconf is unavailable), and Windows exports a POSIX-compatible GNUPGHOME while preserving the native path in action state. Added regression coverage and regenerated the action bundles.