Support making github sided gpg signatures for pull request commits.

[AraHaan]

Subject of the issue

I would like it where the commits generated by create-pull-request had an optional feature when can set to true (if they want it) to use github's gpg signature like you can when manually editing files on github itself.

Steps to reproduce

If this issue is describing a possible bug please provide (or link to) your GitHub Actions workflow.
N/A this is a feature request.

[peter-evans]

use github's gpg signature like you can when manually editing files on github itself

Correct me if I'm wrong, but I don't think this is possible because GitHub's GPG private key is not accessible and/or usable on the GitHub Actions runner. However, I might be able to enable this feature for use with your own GPG private key. This would be similar to the flow described here: https://docs.github.com/en/github/authenticating-to-github/about-commit-signature-verification#gpg-commit-signature-verification

[AraHaan]

Well @peter-evans somehow the automerge action when using the github provided commit information somehow gpg signs the merged commits using github's key as far as I seen (and I used squash merging to merge on it's settings with update setting on their end to rebase).

[peter-evans]

@AraHaan What GitHub action are you referring to? Please could you link the repository.

[AraHaan]

this one https://github.com/pascalgn/automerge-action

[peter-evans]

The reason it works for merging in automerge-action is because it uses the GitHub API to perform the merges. The GitHub API obviously has access to its own private key for signing. In contrast, this action creates git commits on the Actions runner. To sign those commits the action would need access to a private key.

So I can probably find a way to enable this feature for use with your own GPG private key. It would still say "verified" next to the commit just like the GitHub signed commits.

[AraHaan]

...