Feedback Wanted: Persistent Commit Signature Verification (GA)

[leobalter]

Select Topic Area

Product Feedback

Body

Hi everyone!

We just released a public preview for persistent commit signature records this week, and we'd love your feedback! 🎉

With this feature, GitHub verifies commit signatures when they are first pushed. Once a commit’s signature is verified, it remains verified within its repository's network. This helps organizations maintain a secure and accurate record of contributions without needing to recheck the validity of every signature constantly.

You can view these persistent verifications directly on GitHub. Hover over the Verified badge to see the timestamp of the original verification.

Check out the docs to learn more.

If you have questions or feedback, feel free to post them here!
For bugs or deeper inquiries, please reach out to support.

[phj-incom]

Can commits made with the default GITHUB_TOKEN in a github actions workflow run now be verified by default? Or how about commits made by the GitHub REST API?

[leobalter]

No changes to commits using the default GITHUB_TOKEN, those not verified by default.

Commits made by the REST API might get verified, assuming the actor is a bot.

[cvyl]

Awesome! This will be useful for revoking personal PGP keys at my job.