GPG signature lost when merging a PR

[Primajin]

I have all my commits GPG signed.
It shows correctly in the commits of the PR

Once that PR is merged into main it loses all GPG signatures.

Since I have vigilant mode active the PR commits in main are flagged.
I would want the PR to be GPG signed when merged by me.

[sdavids]

GitHub should not use the --no-ff rebase option, thereby preserving the existing signed commits.

https://git-scm.com/docs/git-rebase#Documentation/git-rebase.txt---force-rebase

All the amazing work you did on Managing commit signature verification is practically useless when you use your PR workflow which almost every open source project does.

[Primajin]

I had a chat with the support and they came back with this:

I've had a look into this you can use merging strategies squash and merge and merge commit to make sure your commits are verified.

I do agree that if these commits through the UI are verified, then rebase and merge should be too! This is something our engineering team are aware of and will hopefully be available in the future.

[castarco]

Related to this one: #5524