GitHub Api Commit

This action commits to the checked-out repo via the graphql mutation createCommitOnBranch. This mutation supports signing commits automatically for the user. This is useful when using a GitHub App to do committing for bot-related commits, and the repo requires signed commits.

It will build a list of file additions and deletions to commit, and just before committing will fetch the latest commit OID from the remote repo. It will commit to whatever branch is currently checked out in the workflow. For instance, if you create a branch via git checkout -b my-test-branch in one of your steps, it will commit to my-test-branch.

Usage:

  - name: Commit changes
    uses: step-security/github-api-commit-action@v1
    with:
      commit-message: "<commit-message>" # Commit message defaults to "Commit performed by step-security/github-api-commit-action"
      create-branch-on-remote: true | false # Whether to create the branch on the remote if it doesn't exist: Defaults to false
      stage-all-files: true | false # Whether to additionally stage any changed files in the checkout. Defaults to false
      token: ${{ github.token }} # Token you want to authenticate with

Example: Using a GitHub App Installation Token

  - uses: actions/create-github-app-token@v2
    id: get_installation_token
    with:
      app_id: ${{ secrets.GITHUB_APP_ID }}
      private_key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}

  - name: Commit changes
    uses: step-security/github-api-commit-action@v1
    with:
      commit-message: "<commit-message>" # Commit message defaults to "Commit performed by step-security/github-api-commit-action"
      create-branch-on-remote: true | false # Whether to create the branch on the remote if it doesn't exist already: Defaults to false
      stage-all-files: true | false # Whether to additionally stage any changed files in the checkout. Defaults to false
      token: ${{ steps.get_installation_token.outputs.token }} # Token you want to authenticate with

Committing in your workflow can normally be done using git commands or other actions that perform commits for you. However, if you are using a GitHub App installation token and your repository requires commit signing, there is no way to attach a signing key to your commit, and it must be done through the GitHub API.

The general steps are:

1. Create a tree
2. Create a commit
3. Update the head reference

An example can be found here.

When committing through the GitHub API using a GitHub App installation token, GitHub will recognize the app and add commit signing for you.