Support making github sided gpg signatures for pull request commits.

[AraHaan]

Subject of the issue

I would like it where the commits generated by create-pull-request had an optional feature when can set to true (if they want it) to use github's gpg signature like you can when manually editing files on github itself.

Steps to reproduce

If this issue is describing a possible bug please provide (or link to) your GitHub Actions workflow.
N/A this is a feature request.

[peter-evans]

use github's gpg signature like you can when manually editing files on github itself

Correct me if I'm wrong, but I don't think this is possible because GitHub's GPG private key is not accessible and/or usable on the GitHub Actions runner. However, I might be able to enable this feature for use with your own GPG private key. This would be similar to the flow described here: https://docs.github.com/en/github/authenticating-to-github/about-commit-signature-verification#gpg-commit-signature-verification

[AraHaan]

Well @peter-evans somehow the automerge action when using the github provided commit information somehow gpg signs the merged commits using github's key as far as I seen (and I used squash merging to merge on it's settings with update setting on their end to rebase).

[peter-evans]

@AraHaan What GitHub action are you referring to? Please could you link the repository.

[AraHaan]

this one https://github.com/pascalgn/automerge-action

[peter-evans]

The reason it works for merging in automerge-action is because it uses the GitHub API to perform the merges. The GitHub API obviously has access to its own private key for signing. In contrast, this action creates git commits on the Actions runner. To sign those commits the action would need access to a private key.

So I can probably find a way to enable this feature for use with your own GPG private key. It would still say "verified" next to the commit just like the GitHub signed commits.

[AraHaan]

...

[davidboweninrupt]

Hi @peter-evans

I'm not sure if this helps, but I can see dependabot is able to use the Github key so it's commits are verified.

Perhaps it being available for apps and bots doesn't help this action.

https://github.blog/2019-08-15-commit-signing-support-for-bots-and-other-github-apps/

[peter-evans]

Hi @davidboweninrupt

I found some more information here about how you can achieve commit signing by GitHub's own key for GitHub Apps. However, it doesn't help for GitHub Actions, unfortunately.

As I mentioned in an earlier comment, I'm fairly sure I can make this work for your own GPG key, but not GitHub's. If that's something you would be interested in using let me know.

[AraHaan]

I think that could work as well, Even if it allows the "bot" that the action on my workflow uses an PAT with to sign it using the GPG key for that account.

[peter-evans]

Ok, I'll look into adding a feature to use your own GPG key to sign commits then.

[davidboweninrupt]

Thanks for the link signing with a github app. I was chatting about that with a security researcher yesterday and it would be an answer, it's just a lot of work just to get a commit signed :)

It's kind of you to follow through on the request to add GPG signing as part of your action. I can see that being useful.

As I've looked more deeply into this it's become clear that it would be best to not include my GPG for the action to use because then that secret could be used by other things to sign work as me. I'm going to look at getting a GPG key for a machine account and using that. I need to find out if I can create the PR as the machine account instead of it being me.

[AraHaan]

@davidboweninrupt you can, I do it on my submodule update workflow in https://github.com/Elskom/Sdk/

It basically hacks together a faster submodule update than what dependabot offers currently and all powered by this github action. 😃

[davidboweninrupt]

@AraHaan thanks for the link to https://github.com/Elskom/Sdk/ , seeing that action helped inspire me to do the things I needed to do.

@peter-evans thanks for the action, obviously, but also thanks for keeping the documentation up to date and clear. It took my brain a while to realise, but setting the right committer made things awesome and now the flow in our (sadly private) repo is now beautiful.

For reference, I found getting a machine account to do the work for me and having it's own GPG key as a good way to go.

Having a way to tell this action about "my" GPG key would be nice, but I'm doing it using this importer at the moment.

[peter-evans]

I have the feature working. Signed commits look like this:

[davidboweninrupt]

Everything I can see there looks good @peter-evans

[peter-evans]

Released as v3 / v3.9.0

See the documentation for usage details: https://github.com/peter-evans/create-pull-request/blob/master/docs/concepts-guidelines.md#gpg-commit-signature-verification