sign_commit

Overview ¶

Creates a signed Git commit on a branch as the Devsy GitHub App.

Git commits signed locally are unverifiable without a private GPG/SSH key. GitHub instead signs commits it creates itself (committer: web-flow). This tool authenticates as the app installation and creates the commit through the GraphQL createCommitOnBranch mutation, so GitHub signs it and attributes the author to devsy-app[bot].

Credentials reuse the gen_github_app_jwt env vars:

• DEVSY_GITHUB_APP_ID app client ID (iss claim)
• DEVSY_GITHUB_APP_PRIVATE_KEY PEM contents
• DEVSY_GITHUB_APP_PRIVATE_KEY_PATH PEM file path

Usage:

task github:app:sign-commit -- -m "subject" [-b "body"] [files...]

With no file paths, changed files vs origin/main are committed.