Feature Request: Automated signed commits for GitHub Actions if a github-bot

[v1v]

Is your feature request related to a problem?

Signed commits can be done within the existing environment or by the CI if a bot exists.

Solution you'd like

If running for GitHub actions, then I'd like to enable new settings to do the magic

https://gist.github.com/swinton/03e84635b45c78353b1f71e41007fc7c is an example of using the existing GITHUB_TOKEN

actions:
  pull-request:
    kind: "github"
    scmid: default
    spec:
      autogithubbotsign: true

The if autogithubbotsign and CI=true and GitHub actions, then use signing with the Rest API

Alternatives you've considered

Configure the local environment with the GPG as explained in https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

Anything else?

No response

[olblak]

Thanks for the sharing, I wasn't aware of this and it would be a great feature

[olblak]

I am reopening this issue as I spotted some issues which I can't explain yet.

When a pipeline has one target and so one commit, it seems to work great cfr https://github.com/olblak/kubernetes-marketplace/pull/90/commits
where only one commit is expected to be signed.

But if a pipeline has multiple target like this manifest then it opens one pullrequest like olblak/kubernetes-marketplace#91 and remaining commits are not attached to the branch like olblak/kubernetes-marketplace@a331034