Is there a way for the commits to be signed?

[juliojgd]

Hi all,
our organization has a policy in which every commit to a repo must be signed. Is there a way right now for these lines https://github.com/JamesIves/github-pages-deploy-action/blob/dev/src/git.ts#L178-L181 to issue a signed commit?

If not I think we cannot use this action?
Am I right?

Thanks in advance.

[JamesIves]

This is definitely a reasonable request, although I'm wondering what the best way to do this is as I've never actually issued one of these before. Are there any specific credentials that are required to issue a signed commit? I did a quick Google searching and I'm not entirely sure if the SSH key configuration provides the correct credentials needed to perform this action or not.

[juliojgd]

The supported way (that we are aware of) to do this is via API: https://docs.github.com/en/rest/reference/repos#create-or-update-file-contents
With this method we have tested OK that the commit is correctly signed. It is important to not send "author" field as it would avoid the commit to be signed.
We tried with a plain "git commit -m ..." and the commit is not signed.

[juliojgd]

It seems that via API is only possible to commit one file at a time, not very useful 😭