Skip to content

Conversation

@adbutterfield
Copy link

Potentially closes #427

Adds apiProtocol input that can be set to either rest (default) or graphql to use GitHub's graphql API to make the commit for the release PR. When used in combination with setting setupGitUser to false the commit will use the user of the provided GITHUB_TOKEN.

This solves an issue we have at my company where the security team wants us to enforce signed commits on all of our repositories. With this change, the commits are signed with the service account user associated with the GITHUB_TOKEN.

Related change is #391 . However we can't use this approach at my company, as the security team wants us to only use our service account, and to not use GPG keys.

@changeset-bot
Copy link

changeset-bot bot commented Apr 14, 2025

🦋 Changeset detected

Latest commit: 042a1b8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@changesets/action Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@adbutterfield
Copy link
Author

Please let me know if this is something that makes sense for this project. If not, I think we'll just maintain this as a private fork. 🙇

@s0
Copy link
Member

s0 commented Apr 15, 2025

Related change is #391 . However we can't use this approach at my company, as the security team wants us to only use our service account, and to not use GPG keys.

FTR, that mentioned PR (#391) also uses your GitHub token to commit using the API, and doesn't require you to manually set up GPG Keys. 🙂

(You can see linked examples that have committed using the github-actions user and are signed, which is only possible from the API)

@adbutterfield
Copy link
Author

Related change is #391 . However we can't use this approach at my company, as the security team wants us to only use our service account, and to not use GPG keys.

FTR, that mentioned PR (#391) also uses your GitHub token to commit using the API, and doesn't require you to manually set up GPG Keys. 🙂

(You can see linked examples that have committed using the github-actions user and are signed, which is only possible from the API)

(I'm a bit of a noob to all of this), but if #391 can get the job done, SGTM.

@adbutterfield
Copy link
Author

Closing as #391 got merged in.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Recommendation for signing changeset PR commits

2 participants