Issue with LFS and GitHub apps

[devantler]

Hello there 👋🏻

I am trying to use this GitHub Action to update a few LFS files in a PR. I have verified this flow works fine with the GITHUB_TOKEN and permissions:

permissions:
  content: write
  pull-request: write

But as you know, this does not allow the PR created to trigger other workflows. I need that, so I wanted to use a GitHub App instead. But, when I try to do this with a GitHub App with the same permissions it seems it is unable to upload the files to LFS. I have fiddled with it quite a bit, but could not find a reason for it, so I think it might be an issue in the action. Are you aware of this, or can you spot what I am doing wrong?

Here is the workflow that is creating the PR:

• Workflow Run Logs
• Workflow file

Here is the workflow that is trying to retrieve the files from LFS in the PR that was just created:

• Workflow Run Logs
• Workflow file

Can you help me / verify whether this is a bug, or something wrong on my end?

[peter-evans]

Hi @devantler

When you checkout during on: pull_request, it isn't checking out the PR branch, it checks out a "merge commit" which is a kind of virtual commit that only exists on the runner. So that might be the problem.

Try checking out the PR branch head. Note that this only works when the PR is triggered on pull_request (and maybe merge_group but I'm not sure.) So if you need the workflow to work on different events you might need to dynamically change the ref to checkout.

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}

[devantler]

Hi @devantler

When you checkout during on: pull_request, it isn't checking out the PR branch, it checks out a "merge commit" which is a kind of virtual commit that only exists on the runner. So that might be the problem.

Try checking out the PR branch head. Note that this only works when the PR is triggered on pull_request (and maybe merge_group but I'm not sure.) So if you need the workflow to work on different events you might need to dynamically change the ref to checkout.

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}

I will try that. Funny thing is the exact same flow works if i use secrets.GITHUB_TOKEN instead 🤔💭 I would expect that to work the same in this regard.

[devantler]

It seems to not make a difference. So I think something else is going on:

• https://github.com/devantler-tech/dotnet-k9s-cli/actions/runs/13841857698/job/38741380465?pr=124

I believe the files are not uploaded properly, as I also receive this error if I try to checkout the affected branch locally:

> git checkout -q --track origin/update-k9s-binary
Downloading src/Devantler.K9sCLI/runtimes/linux-arm64/native/k9s-linux-arm64 (114 MB)
Error downloading object: src/Devantler.K9sCLI/runtimes/linux-arm64/native/k9s-linux-arm64 (30d440b): Smudge error: Error downloading src/Devantler.K9sCLI/runtimes/linux-arm64/native/k9s-linux-arm64 (30d440b0157d0737188ec926124e1b2a4747bdc4831fdc4c7610ba928d67d5b4): [30d440b0157d0737188ec926124e1b2a4747bdc4831fdc4c7610ba928d67d5b4] Object does not exist on the server: [404] Object does not exist on the server

Errors logged to '/Users/nikolaiemildamm/git-personal/monorepo/.git/modules/libraries/dotnet-k9s-cli/lfs/logs/20250313T223154.856892.log'.
Use `git lfs logs last` to view the log.
error: external filter 'git-lfs filter-process' failed
fatal: src/Devantler.K9sCLI/runtimes/linux-arm64/native/k9s-linux-arm64: smudge filter lfs failed

[peter-evans]

Oh, I think I know the reason. If you use sign-commits: true then it doesn't use Git/LFS to upload, it uploads via the GitHub API. So just remove sign-commits: true or disable it.

[devantler]

Ah, thank you! I will test it, and reach back. Is this a design limitation in the action, or somewhere else? I would like to sign these commits still if at all possible :-)

EDIT: It worked: https://github.com/devantler-tech/dotnet-k9s-cli/actions/runs/13852736793/job/38762899137?pr=125

So the issue is commit signing is not working when using a GitHub App with LFS. I would love to fix it if you can point me to the code that handles this, and a bit of context on why this is necessary in the first place :-) I assume there must be a way to support this.

[peter-evans]

This is the relevant section on commit signing which should explain why the action works this way: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#commit-signing

[peter-evans]

Well maybe it doesn't explain the "why" so much. Basically, the "commit signature verification for bots" feature (enabled with sign-commits: true) must use the GitHub API to upload commits. So naturally, it doesn't use git/lfs to upload.

If you need git/lfs upload, then your only option to sign commits is GPG: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#gpg-commit-signature-verification

[devantler]

Thanks again, I will make sure to share my solution in this issue when I have GPG signing set up for this use case.

[devantler]

Thank you so much for the help @peter-evans.

Here is a working example of creating PRs with signed commits and LFS using a GitHub App with content: write and pull-request: write permissions.

name: 

on: {}

permissions: {}

jobs:
  download-binary:
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub App Token
        uses: tibdex/github-app-token@v2
        id: generate-token
        with:
          app_id: ${{ vars.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
      - uses: actions/checkout@v4
        with:
          lfs: true
          token: ${{ steps.generate-token.outputs.token }}
      - uses: crazy-max/ghaction-import-gpg@v5
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true
      ...
      - name: ✍🏻 Create PR
        uses: peter-evans/create-pull-request@v7
        with:
          committer: user <email@example.com>
          signoff: true
          token: ${{ steps.generate-token.outputs.token }}
          branch-token: ${{ steps.generate-token.outputs.token }}