Support Signed Commits by [e-mail]

Currently if “signed commits” are required in branch protection there is no good way to have actions update code using the token provided for use with github actions and the current repository. Seems like github actions should provide a way for changes made by [e-mail] to be signed and show as verified through the interface.

[instinct-vfx]

Is there any traction at all from github? This is crucial for us as signed commits have been made mandatory for our repositories and creating and managing non-human accounts is not really trivial. In my eyes signed commits need to be supported by github actions directly rather than us having to jump through hoops.

[liyishuai]

What’s the cryptographic purpose for this? If any action can create signed commits under [e-mail], then what does the signature indicate, that the commit was made on GitHub Actions rather than on humans’ local machine?

The actual feature we should propose is to recognize [e-mail] as a non-human account associated with me, and can be verified by my GPG keys. All I need is to store a private key as actions secret and use it for signing the commits.