[FEATURE REQUEST] Support commit signing to work with GitHub Vigilant Mode

[adriangilliam]

Feature Request

Add support for Git commit signing when Claude Code creates commits, respecting the user's existing commit signing configuration.

Current Behavior

When Claude Code creates commits, they are not signed even when the user has commit signing configured locally with:

• commit.gpgsign = true in git config
• GPG or SSH signing keys properly configured
• Signing working correctly for manual commits

Problem

Users with GitHub Vigilant Mode enabled see Claude's commits marked as "Unverified", which:

• Creates visual inconsistency in commit history
• Can trigger organizational compliance warnings
• Requires manual amendment of commits to add signatures

Many organizations require all commits to be signed as part of their security policies.

Proposed Solution

Claude Code should detect and respect the user's commit signing configuration:

1. Check for signing configuration:

   • git config commit.gpgsign
   • git config user.signingkey
   • git config gpg.format (GPG vs SSH)

2. When creating commits:

   • If signing is configured, add appropriate signing flags
   • For GPG: git commit -S
   • For SSH: ensure gpg.format=ssh is respected

3. Graceful fallback:

   • If signing fails, warn the user but still create unsigned commit

Example Implementation

# Check if signing is enabled
if git config --get commit.gpgsign | grep -q true; then
    # Use -S flag for signed commits
    git commit -S -m "message"
else
    # Standard commit without signing
    git commit -m "message"
fi

Related Documentation

• GitHub: About commit signature verification
• Git: Signing Your Work

[coygeek]

Hey, this is a fantastic feature request. I ran into the same issue myself. Our org requires all commits to be signed, and having Claude's commits show up as "Unverified" on GitHub is a nuisance, especially with Vigilant Mode enabled. It's becoming a standard security practice, so native support for this would be a huge win.

While we wait for the official team to hopefully implement this, I think I found a decent workaround using a custom slash command. It's not perfect because you have to explicitly tell Claude to use it, but it saves you from having to manually amend every commit.

Here’s how you can set it up:

1. Create a project-specific command file. In your project's root, run:

   mkdir -p .claude/commands

2. Create a new file named .claude/commands/commit.md and add the following content:

   ---
   description: Creates a GPG/SSH signed git commit.
   argument-hint: [commit message]
   allowed-tools: Bash(git commit:*)
   ---
   !git commit -S -m "$ARGUMENTS"

How this works:

• This creates a new /commit slash command that Claude can use.
• The !git commit -S -m "$ARGUMENTS" line executes the git commit command with the crucial -S flag for signing. Whatever you type after /commit gets passed in as the message.
• It respects your local git and GPG/SSH agent setup, so it should just work if your manual signed commits are already working.

How to use it:

Now, instead of asking Claude to "commit the changes," you can guide it to use your new command:

> Use the /commit command to create a signed commit with the message "feat: Add new user authentication flow"

It's an extra step, but it gets the job done. You could even add an instruction to your project's CLAUDE.md file to remind Claude to prefer using /commit for creating commits.

Hope this helps you out in the meantime!

[lorenzleutgeb]

You can sign a range of commits using git rebase --exec, e.g. git rebase --exec 'git commit --amend --no-edit --no-verify --gpg-sign'.

[github-actions]

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

[TyceHerrman]

keep open

[github-actions]

This issue has been automatically closed due to 60 days of inactivity. If you're still experiencing this issue, please open a new issue with updated information.

[marcindulak]

This issue was closed incorrectly despite recent human comments. This behavior of the bot is reported at #16497. Upvote or comment on that issue, so maybe it gets noticed.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.