Skip to content

Commit 48ef8e2

Browse files
authored
Add additional motivation to README (#15)
1 parent 642fb77 commit 48ef8e2

File tree

1 file changed

+14
-6
lines changed

1 file changed

+14
-6
lines changed

README.md

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,24 @@ NPM / TypeScript package to commit changes GitHub repositories using the GraphQL
66

77
## Why?
88

9-
If you or your organisation has strict requirements
10-
around requiring signed commits (i.e. via Branch Protection or Repo Rulesets), then this can make integrating CI workflows or applications that are designed to make changes to your repos quite difficult. This is because you will need to manage your own GPG keys, assign them to machine accounts (which also means it doesn't work with GitHub Apps), and securely manage and rotate them.
9+
- **Simplified GPG Signing:**
1110

12-
Instead of doing this, if you use the GitHub API to make changes to files (such as what happens when making changes to files directly in the web UI), then GitHub's internal GPG key is used, and commits are all signed and associated with the user of the access token that was used.
11+
If you or your organisation has strict requirements
12+
around requiring signed commits (i.e. via Branch Protection or Repo Rulesets), then this can make integrating CI workflows or applications that are designed to make changes to your repos quite difficult. This is because you will need to manage your own GPG keys, assign them to machine accounts (which also means it doesn't work with GitHub Apps), and securely manage and rotate them.
1313

14-
(And this also works with GitHub Apps too, including the GitHub Actions app).
14+
Instead of doing this, if you use the GitHub API to make changes to files (such as what happens when making changes to files directly in the web UI), then GitHub's internal GPG key is used, and commits are all signed and associated with the user of the access token that was used.
1515

16-
![](docs/verified.png)
16+
(And this also works with GitHub Apps too, including the GitHub Actions app).
1717

18-
This library has primarily been designed for use in custom Node GitHub Actions, but can be used in any Node.js or JavaScript project that needs to directly modify files in GitHub repositories.
18+
![](docs/verified.png)
19+
20+
This library has primarily been designed for use in custom Node GitHub Actions, but can be used in any Node.js or JavaScript project that needs to directly modify files in GitHub repositories.
21+
22+
- **Simplified Git Config:**
23+
24+
When performing git actions via the GitHub API, all actions are always attributed to the actor whose `GITHUB_TOKEN` is being used (whether an app, or user), and this information is reflected in the git committer and author. As such, it's no longer necessary (or even possible) to specify the commit author (name and email address).
25+
26+
This simplifies the process of preparing your workflows for pushing changes, as you no longer need to configure the name and email address in git, and ensure they appropriately match any GPG keys used.
1927

2028
## Usage
2129

0 commit comments

Comments
 (0)