Make bots sign their commits - #8963
Open
andrewlock wants to merge 9 commits into
Open
Conversation
Wraps DataDog/commit-headless so bot workflows can create GitHub-signed commits
Also drops the milestone input: it referenced steps.rename.outputs, and there is no step with that id, so it always resolved to empty
The base branch now has to be stated explicitly: peter-evans defaulted it to the checked-out ref (the release branch), whereas gh defaults to the repository default branch.
The local git checkout -b is gone: commit-headless creates the remote branch itself via create-branch, using the dispatched tag as the branch point. The default GITHUB_TOKEN is enough, as the job already declares contents: write.
Corrects the bot email to the 41898282+ form GitHub actually attributes commits to.
All workflows that create commits now push through the GitHub API, so the excluded_emails escape hatch is no longer needed.
peter-evans/create-pull-request has a sign-commits input, which creates the commit through the GitHub API rather than pushing it over git. It needs a bot token to sign, and our dd-octo-sts tokens are GitHub App tokens, so it applies here. That replaces the staging, commit-headless call and gh plumbing with a single delegation, removing all the bash from this action. Keeping the wrapper means sign-commits is always set, so a workflow cannot leave it off, and the signing mechanism can still be swapped in one place. Callers are unchanged; every input they pass is still accepted.
andrewlock
added
the
area:builds
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01acf9affc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Create Pull Request | ||
| id: pr | ||
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | ||
| uses: ./.github/actions/create-signed-pull-request |
There was a problem hiding this comment.
When a v1.* or v2.* release is published, the earlier checkout replaces the workspace with release/1.x or release/2.x. Because this composite action is newly added on master, those existing branches do not receive .github/actions/create-signed-pull-request/action.yml automatically, so the runner will stop at this step instead of creating the version-bump PR. Invoke the pinned third-party action directly here, separately check out/copy the composite action, or backport it to every selected branch.
Useful? React with 👍 / 👎.
Member
Author
There was a problem hiding this comment.
probably "meh" seeing as we're not actually creating releases from those branches any more...
Member
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
BenchmarksBenchmark execution time: 2026-07-30 16:41:36 Comparing candidate commit 01acf9a in PR branch Found 0 performance improvements and 1 performance regressions! Performance is the same for 70 metrics, 1 unstable metrics, 64 known flaky benchmarks, 62 flaky benchmarks without significant changes.
|
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8963) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8963) - mean (72ms) : 69, 74
master - mean (71ms) : 69, 73
section Bailout
This PR (8963) - mean (79ms) : 76, 83
master - mean (79ms) : 73, 84
section CallTarget+Inlining+NGEN
This PR (8963) - mean (1,096ms) : 1044, 1148
master - mean (1,096ms) : 1041, 1152
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8963) - mean (114ms) : 109, 120
master - mean (113ms) : 107, 120
section Bailout
This PR (8963) - mean (113ms) : 108, 119
master - mean (115ms) : 110, 120
section CallTarget+Inlining+NGEN
This PR (8963) - mean (783ms) : 766, 799
master - mean (785ms) : 766, 803
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8963) - mean (101ms) : 96, 107
master - mean (100ms) : 96, 103
section Bailout
This PR (8963) - mean (102ms) : 96, 108
master - mean (102ms) : 98, 107
section CallTarget+Inlining+NGEN
This PR (8963) - mean (947ms) : 905, 990
master - mean (948ms) : 900, 995
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8963) - mean (96ms) : 93, 99
master - mean (97ms) : 94, 99
section Bailout
This PR (8963) - mean (100ms) : 94, 107
master - mean (99ms) : 95, 104
section CallTarget+Inlining+NGEN
This PR (8963) - mean (822ms) : 786, 857
master - mean (824ms) : 775, 873
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8963) - mean (210ms) : 206, 214
master - mean (209ms) : 203, 215
section Bailout
This PR (8963) - mean (214ms) : 210, 217
master - mean (214ms) : 210, 217
section CallTarget+Inlining+NGEN
This PR (8963) - mean (1,252ms) : 1211, 1292
master - mean (1,251ms) : 1208, 1294
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8963) - mean (299ms) : 293, 305
master - mean (299ms) : 293, 306
section Bailout
This PR (8963) - mean (299ms) : 294, 304
master - mean (301ms) : 296, 306
section CallTarget+Inlining+NGEN
This PR (8963) - mean (994ms) : 973, 1016
master - mean (995ms) : 971, 1019
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8963) - mean (291ms) : 286, 295
master - mean (294ms) : 289, 299
section Bailout
This PR (8963) - mean (292ms) : 288, 296
master - mean (293ms) : 289, 298
section CallTarget+Inlining+NGEN
This PR (8963) - mean (1,194ms) : 1152, 1236
master - mean (1,191ms) : 1147, 1236
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8963) - mean (293ms) : 288, 297
master - mean (293ms) : 288, 299
section Bailout
This PR (8963) - mean (293ms) : 289, 297
master - mean (294ms) : 290, 298
section CallTarget+Inlining+NGEN
This PR (8963) - mean (1,083ms) : 994, 1171
master - mean (1,076ms) : 1006, 1146
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
create-signed-pull-requestaction which will create a PR using signed commitspeter-evans/create-pull-requestdirectlyDataDog/commit-headlessto create signed commits without a PRReason for change
We need to enable commit-signing enforcement; today, these bot commits are not signed.
Implementation details
peter-evans/create-pull-requestto ensure we always create signed commitsDataDog/commit-headlessGitHub Action to create signed commits without a PROriginally I removed peter-evans/create-pull-request entirely, and worked with the
ghAPI directly, but it was a lot of bash effort and this is arguably simpler to understand. But we could switch it out later more easily if we need to, and as it's now all in one place, that becomes a lot easier (just revert my final commit on this branch).Test coverage
Not easy to test this stuff, so to an extent we'll just have to push it and see, and wait to make sure everything we think should be signed, is! We could also not remove the exclusions for now, and instead remove them in a later commit, but I don't think that's necessary right now, and it's a quick fix if it is.