asana/Diff a local and remote branch, and use createCommitOnBranch to push copies of local commits to the remote

This composite Github Action was designed to allow Github Apps to push 'Verified' commits to Github. Per https://github.com/orgs/community/discussions/50055, historically the only way to create 'signed' commits as a Github App installation was to use the Git database APIs (described at https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28). These APIs are complicated, and it's a challenging multi-step process to implement commit verification with them. In 2021, Github released the createCommitOnBranch GraphQL mutation, which makes it easier to add, update, and delete files in a branch of a repository. This new API offers a simpler way to commit changes compared to the existing Git database REST APIs. With the new createCommitOnBranch mutation, you do not need to manually create blobs and trees via separate API calls before creating the commit. This allows you to add, update, or delete multiple files in a single API call. The push-signed-commits composite action uses the new createCommitOnBranch GraphQL endpoint to create verified commits on a remote branch. This GraphQL API extracts authorship information from the credential used for authentication, and automatically marks commits created using Github App installation credentials as "verified". Read more about this new mutation and its conveniences here: https://github.blog/changelog/2021-09-13-a-simpler-api-for-authoring-commits/

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Mar 14, 2026
License
None

Pinned Snippet

workflow.ymlSHA-pinned
uses: asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897 # v1

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
github-tokenGitHub tokenyes
ownerRepository owneryes${{ github.repository_owner }}
repoRepository nameyes${{ github.repository }}
local_branch_nameLocal branch nameyes
remote_branch_nameRemote branch name - should not include refs/heads/ prefix or origin/ prefixyes
remote_nameThe name of the remote to push to, pre-configured in the local git repo. eg., `origin`origin
log_levelLog level, specified using the standard Python logging module levels. Default is WARN. Options are DEBUG, INFO, WARN, ERROR.WARN
python-versionPython version to use. Defaults to 3.9.3.9

no outputs