Recommendation for signing changeset PR commits

[jacksonneal]

I want to be able to verify the commits made to the version PR. Right now, my commits are unverified. Is there a recommended strategy for signing and verifying commits? I was looking at the documentation from GitHub here. Should I be trying to use the GitHub API to commit?

Judging by this article, using the github API would be one option. It would be great if the action supported this.

[ryanbas21]

I happen to be looking into this as well - but specifically from an organization standpoint. I see changesets has thier commits signed so maybe @Andarist could weigh in.

I see this in the github docs: https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#signature-verification-for-bots

Organizations and GitHub Apps that require commit signing can use bots to sign commits. If a commit or tag has a bot signature that is cryptographically verifiable, GitHub marks the commit or tag as verified.

Signature verification for bots will only work if the request is verified and authenticated as the GitHub App or bot and contains no custom author information, custom committer information, and no custom signature information, such as Commits API.

But currently my pipeline isn't signing the commits when setting up git via the setupGitUser option. My guess is maybe I'll have to add my github token to the checkout command, i'll have to see if i'm doing this.

Just commenting to follow along and say i'm also looking into this. Would love to see if theres something missing / could be documented

[jacksonneal]

I think the commits are unsigned on the PR's branch and then, on merge, the commit is signed because merge happened via the UI. This doesn't work for me because we are blocking merges to main unless the commits are signed.

In the meantime, I've created a utility script that checks out the PR's branch and rewrites the history, signing the commit when ran locally. This works, but is just another step when releasing.