Sign commits made by GitHub Actions workflow?

Question

I have a GitHub Actions workflow that automatically creates PRs for an access review. The commits are made by:

      - name: Configure Git
        run: |
          git config user.name "ur-access-bot"
          git config user.email "[email protected]"

which is set in one of the steps.

But my org forces all commits to be signed and I don't know how to sign it with GPG in this case. So far I cannot see that this is possible, but that I should rather use a GitHub App since then commits made by apps don't have to be explicitly signed.

If it's possible to sign the commit in a similar way to when a normal user does it, I would rather do that. Is it possible?

Grzegorz Krukowski · Accepted Answer · 2025-09-12 13:35:11Z

2

It is possible - you need to import you GPG keys and configure commits to use it.

The easiest will be to use one of the existing actions, for example:

- name: Configure GPG
  uses: crazy-max/ghaction-import-gpg@v2
  with:
     git_user_signingkey: true
     git_commit_gpgsign: true
  env:
     GPG_PRIVATE_KEY: ${{ secrets.GPG_KEY }}
     PASSPHRASE: ${{ secrets.GPG_PASS }}

answered Sep 12 at 13:35

Grzegorz Krukowski

20.1k5 gold badges61 silver badges80 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

vbnm Sep 15 at 8:43

I tried this but the workflow gives an error saying: remote: - Commits must have verified signatures. I asked chatGPT and it says that the public key associated with the private key has to be linked to a real GitHub account. The one I create has no real account behind it, it's just created on the fly. So I assume in my case that it's not possible to sign commits.

Grzegorz Krukowski Sep 16 at 7:41

Create a bot account for such operations and use that as your main actor for things like that

Collectives™ on Stack Overflow

Sign commits made by GitHub Actions workflow?

1 Answer 1

2 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Related