GPG App Usage

[jarrodldavis]

Hi there,

I noticed that you are using my GPG GitHub App to make sure pull request commits are signed with valid GPG signatures.

Unfortunately, I've stopped working on this app quite some time ago because I had issues getting correct information from the GitHub API. You may have noticed some false negatives, especially when pushing new commits to an existing pull request.

Additionally, it seems GitHub has recently added a "Require signed commits" option for branch protection, as seen below:

While I don't plan on taking down the hosted version of the GitHub App any time soon, I would strongly recommend either using this new built-in option or forking and hosting your own version of the app (with your own fixes and improvements) since I don't plan on updating it.

[iphydf]

Thanks, we use both "Require signed commits" and the GPG app for now. The GPG app gives positive feedback, while the github thing only tells you when it fails, so the observable behaviour of "you didn't enable the checkbox" and "everything is ok" is the same. As long as the GPG app still works, we'll keep using it. Once it breaks too much, we'll stop.