ci: sign release commits via create-pull-request [SEC-2046]#313
Merged
leifdreizler merged 1 commit intoMay 5, 2026
Merged
Conversation
…signed commits [SEC-2046] Replaces manual git push + gh pr create with peter-evans/create-pull-request using sign-commits: true. Commits are made via the GitHub API and signed by GitHub's web-flow key, satisfying "Require Signed Commits" without needing the release app on the org-wide bypass list. The app token mint is preserved so that the resulting PR triggers downstream CI workflows (PRs opened by GITHUB_TOKEN do not). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
leifdreizler
force-pushed
the
leif/sec-2046-semgrep-vscode-replace-github-actionsbot
branch
from
April 30, 2026 20:54
55b6704 to
cc4f6f2
Compare
leifdreizler
changed the title
leifdreizler
marked this pull request as ready for review
April 30, 2026 21:53
leifdreizler
changed the title
liukatkat
approved these changes
May 5, 2026
leifdreizler
deleted the
leif/sec-2046-semgrep-vscode-replace-github-actionsbot
branch
May 5, 2026 16:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The default
secrets.GITHUB_TOKENruns asgithub-actions[bot]and produces unsigned commitsSolution
Replace the manual
git push+gh pr createflow withstep-securitycreate-pull-requestusingsign-commits: true. The action commits via the GitHub API, so commits are signedVerification
Produced this PR #314