magmanu/github-actions-bot-signed-commit
Sign commits using GitHub App or GITHUB_TOKEN. Compatible with large and binary files.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Dec 11, 2025
- License
- None
Pinned Snippet
uses: magmanu/github-action-bot-signed-commit@fb2582c7c22a7183a95504156c4ac02bb734d6ed # v1.0.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| TOKEN | If signing commits with Github Apps, provide the App token. Else, it defults to GITHUB_TOKEN. | no | ${{ github.token }} |
| TARGET_OWNER | The repository owner (user/org) | no | ${{ github.repository_owner }} |
| TARGET_REPO | The repository where the signed commits will be pushed to. | no | ${{ github.event.repository.name }} |
| TARGET_REF | The branch where the signed commits will be pushed to. | no | ${{ github.head_ref || github.ref_name }} |
| FILE_LIST | Absolute path to a text file containing the list of file paths to be committed. | yes | — |
| WORKING_DIR | The absolute path for the working directory where the action will run. | no | ${{ github.workspace }} |
| IS_DRY_RUN | If set to true, the action will push the commits but leave them orphans (the head won't move.) | no | false |
| SHOULD_CREATE_NEW_BRANCH | If set to true, the action will create the target branch if it doesn't exist. | no | true |
| COMMIT_MESSAGE | The commit message to use for the signed commits. Your message will be suffixed with a UTC human-friendly timestamp. | no | Signed commit |
Outputs
| name | description |
|---|---|
| sha | SHA of the verified commit |