pgaskin/Push signed commits

Create verified commits for bots or workflows via the GitHub API

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit May 31, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: pgaskin/push-signed-commits@5055c5f30c4dca7aa847ed2f07683d7359b8ff2b # v1.2.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
path	The local repository path relative to the current directory. If you change this, you probably also want to change the 'repository' and 'branch'.	—	—
repository	The target repository username/name if not the same as the workflow. This does not need to match the local repo upstream. If not on the same GitHub server as the workflow, you need to override the GITHUB_API_URL and GITHUB_GRAPHQL_URL environment variables.	—	${{ github.repository }}
branch	The target branch name if not the same as the workflow ref, optionally including the 'refs/heads/' prefix. This does not need to match the local repo branch. You cannot push to tags.	—	${{ github.ref }}
revision	The commit or commit range to push to the remote. If you want to push the last local commit, use 'HEAD'. If the local branch has an upstream set, you can use 'HEAD@{u}..HEAD' to push all commits added since the last pull. Note that force-pushes are not supported and will be rejected. See https://git-scm.com/docs/gitrevisions. If not set, a new commit will be created from the staging area.	—	—
allow-empty	Whether to make a new commit from the staging area even if there's nothing to commit. Only used if 'revision' is not set.	—	false
commit-message	The commit message to use if creating a new commit from the staging area.	—	automatic commit
commit-message-file	The file to read the commit message from. Overrides commit-message.	—	—
user-agent	Override the user agent used to make GitHub API requests.	—	—
insecure	Do not validate SSL certificates when making GitHub API requests.	—	false
dry-run	Do not push commits, just print the mutations which would be made.	—	false
github-token	The token to use to make GitHub API requests.	—	${{ github.token }}
github-api-url	GitHub API URL. If not set, it will be set from GITHUB_API_URL to be the same as the one where the workflow is running from (e.g., https://api.github.com or https://my-ghes-server.example.com/api/v3).	—	—
github-graphql-url	GitHub GraphQL API URL. If not set, it will be set from GITHUB_GRAPHQL_URL to be the same as the one where the workflow is running from (e.g., https://api.github.com/graphql or https://my-ghes-server.example.com/api/graphql).	—	—
app-id	Authenticate as a GitHub App with the specified ID (App ID or Client ID). The installation ID will be detected based on 'repository'. Overrides 'github-token'. The app must have the 'contents:write' permission. If you already have an app installation token, you can pass it via 'github-token' instead.	—	—
app-key	The private key to use if authenticating as a GitHub App. Can be base64-encoded or contain escaped ('\n') newlines.	—	—
git-binary	The git binary to use. If not sepecified, the one in the PATH is used.	—	—

Outputs

name	description
not-pushable	Set to true if one or more commits were not pushed (the oid outputs will still be set to the ones pushed so far) since they contained unpushable content.
pushed-oids	The new commit hash of all commits pushed, space-separated. On failure, it contains the ones pushed so far. Not set if 'dry-run'.
pushed-oid	The new commit hash of the last commit pushed, or an empty string if no commits were pushed. On failure, it contains the ones pushed so far. Not set if 'dry-run'.
local-commit-oids	The local commit hashes of all commits pushed corresponding to the ones in commit-oids. Not set if creating a new commit from the staging area. Still set if 'dry-run'.
local-commit-oid	The local commit hashes of the last commit pushed corresponding to the ones in commit-oids. Not set if creating a new commit from the staging area. Still set if 'dry-run'.