asana/Diff a local and remote branch, and use createCommitOnBranch to push copies of local commits to the remote
This composite Github Action was designed to allow Github Apps to push 'Verified' commits to Github. Per https://github.com/orgs/community/discussions/50055, historically the only way to create 'signed' commits as a Github App installation was to use the Git database APIs (described at https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28). These APIs are complicated, and it's a challenging multi-step process to implement commit verification with them. In 2021, Github released the createCommitOnBranch GraphQL mutation, which makes it easier to add, update, and delete files in a branch of a repository. This new API offers a simpler way to commit changes compared to the existing Git database REST APIs. With the new createCommitOnBranch mutation, you do not need to manually create blobs and trees via separate API calls before creating the commit. This allows you to add, update, or delete multiple files in a single API call. The push-signed-commits composite action uses the new createCommitOnBranch GraphQL endpoint to create verified commits on a remote branch. This GraphQL API extracts authorship information from the credential used for authentication, and automatically marks commits created using Github App installation credentials as "verified". Read more about this new mutation and its conveniences here: https://github.blog/changelog/2021-09-13-a-simpler-api-for-authoring-commits/
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 14, 2026
- License
- None
Pinned Snippet
uses: asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897 # v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token | yes | — |
| owner | Repository owner | yes | ${{ github.repository_owner }} |
| repo | Repository name | yes | ${{ github.repository }} |
| local_branch_name | Local branch name | yes | — |
| remote_branch_name | Remote branch name - should not include refs/heads/ prefix or origin/ prefix | yes | — |
| remote_name | The name of the remote to push to, pre-configured in the local git repo. eg., `origin` | — | origin |
| log_level | Log level, specified using the standard Python logging module levels. Default is WARN. Options are DEBUG, INFO, WARN, ERROR. | — | WARN |
| python-version | Python version to use. Defaults to 3.9. | — | 3.9 |
Outputs
no outputs