Feature request: Support creating signed commits

[Vechro]

It doesn't seem like it's currently possible to configure the action to create signed commits.

Would it be possible to add support for this? I would've assumed that running https://github.com/crazy-max/ghaction-import-gpg with git_commit_gpgsign: true before this action would be enough to make the commits signed automatically but that doesn't seem to be working.

[mscharley]

This action doesn't use git at all currently, it uses Github's API to create commits directly in Github. Github used to treat commits made this way as trusted/verified but this changed at some point. This is definitely something I'd like to get going too, but the intended workflow specifically doesn't do a checkout so I'm at a loss currently how to work around this.

If you haven't already read it, this is a really good read about some of the security concerns I'm trying to dodge: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

It wouldn't be impossible to work with a real git checkout, but that feels like it would be encouraging some bad ideas. The git checkout itself is safe, but that's only one step from npm install which is very much not safe if you're using a PAT which I do encourage people to use, so I designed this to work completely standalone.

[mscharley]

Looking at the API again today, it looks like you might be able to add a signature with the commit object you're creating? I'll have to look into this some more.

reference: https://docs.github.com/en/rest/git/commits?apiVersion=2022-11-28#create-a-commit

[Vechro]

Oh I see, I wasn't aware of these nuances with GitHub, thanks for looking into this. This feature would be really useful in repositories that require PRs to have signed commits.

[mscharley]

There is now a new sign-commits option you can enable, but there's some limitations so I'm going to leave this ticket open for now in the hopes of a better long term solution.

Current limitations

1. No custom author. This makes it harder to integrate securely with Renovate which needs to ignore a specific author (well, as much as authors are 'secure'. This is more a 'prevents accidents' feature)
2. PAT's can't be used to connect from one personal account to a repo in another personal account. This rules out using a machine user to get a custom author unless the repos are hosted in a Github organisation.