sign_commit

Overview ¶

Creates a signed Git commit on a branch as the Devsy GitHub App.

Git commits signed locally are unverifiable without a private GPG/SSH key. GitHub instead signs commits it creates itself (committer: web-flow). This tool authenticates as the app installation and creates the commit through the GraphQL createCommitOnBranch mutation, so GitHub signs it and attributes the author to devsy-app[bot].

Credentials reuse the gen_github_app_jwt env vars:

• DEVSY_GITHUB_APP_CLIENT_ID app client ID (preferred iss claim)
• DEVSY_GITHUB_APP_ID numeric app ID (legacy iss fallback)
• DEVSY_GITHUB_APP_PRIVATE_KEY PEM contents
• DEVSY_GITHUB_APP_PRIVATE_KEY_PATH PEM file path

Usage:

task github:app:sign-commit -- -m "subject" [-b "body"] [files...]
task github:app:sign-commit -- -m "subject" -pr   (commit + open draft PR)
task github:app:sign-commit -- -m "subject" -pr-only   (open draft PR only)
task github:app:sign-commit -- -token   (print the app installation token)