Skip to content

feat: add input to enable gpg commit signing#795

Merged
peter-evans merged 1 commit intomasterfrom
gpg-sign
May 9, 2021
Merged

feat: add input to enable gpg commit signing#795
peter-evans merged 1 commit intomasterfrom
gpg-sign

Conversation

@peter-evans
Copy link
Owner

@peter-evans peter-evans commented May 8, 2021

Fixes: #708

@github-actions
Copy link
Contributor

github-actions bot commented May 8, 2021

Full test suite slash command (repository admin only)

/test repository=peter-evans/create-pull-request ref=gpg-sign build=true

@peter-evans
Copy link
Owner Author

peter-evans commented May 8, 2021

/test repository=peter-evans/create-pull-request ref=gpg-sign build=true

Command run output

@peter-evans
Copy link
Owner Author

peter-evans commented May 9, 2021

/test repository=peter-evans/create-pull-request ref=gpg-sign

Command run output

@peter-evans
Copy link
Owner Author

peter-evans commented May 9, 2021

/test repository=peter-evans/create-pull-request ref=gpg-sign

Command run output

@peter-evans
Copy link
Owner Author

peter-evans commented May 9, 2021

/test repository=peter-evans/create-pull-request ref=gpg-sign

Command run output

@peter-evans peter-evans marked this pull request as ready for review May 9, 2021 01:18
@peter-evans
Copy link
Owner Author

peter-evans commented May 9, 2021

/test repository=peter-evans/create-pull-request ref=gpg-sign build=true

Command run output

@peter-evans peter-evans merged commit 1ff93da into master May 9, 2021
@peter-evans peter-evans deleted the gpg-sign branch May 9, 2021 05:15
@AraHaan
Copy link

AraHaan commented May 9, 2021

@davidboweninrupt this action actually does the commiting and pushing of the data to a branch for you and as such would have to tell git to gpg sign the commit.

@davidboweninrupt
Copy link

davidboweninrupt commented May 9, 2021

@AraHaan I thought so too, but I had this working before the new feature came online just by using ghaction-import-gpg.

I think it's because I'm setting git-commit-gpgsign: true during the GPG import which sets commit.gpgsign to true (which is what I was verifying this afternoon).

image

Once that flag is set the docs say:

To sign all commits by default in any local repository on your computer, run git config --global commit.gpgsign true.

which means you don't need to pass the switch to each invocation (which is what I believe the new feature is doing).

Of course there might be something I'missing.

@peter-evans
Copy link
Owner Author

@davidboweninrupt I think you're right. I overlooked the fact it was setting git's global config. I'm going to test it myself and make a fix to remove the gpg-sign input because it appears to be unnecessary.

I think I'd envisaged you doing something like ghaction-import-gpg does, but if you'd prefer to use it in the pipeline to specify the details of the GPG setup then I don't believe you needed this new capability in create-pull-request. I'm fine with including the other action in my pipeline if that's the preferred approach.

Yes, this is my preferred approach. ghaction-import-gpg appears to be well maintained and does the job well so I don't think there is any reason to try and duplicate that logic in this action at the moment.

@peter-evans
Copy link
Owner Author

Removed the gpg-sign input in #804

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support making github sided gpg signatures for pull request commits.

3 participants