GitHub App verified commits with REST API: Deletions are not signed

[rtyley]

Select Topic Area

Bug

Body

If you look at this commit history in GitHub, you'll see 2 commits generated using the GitHub REST API by a GitHub App I use for testing:

Both commits were generated using the GitHub REST API, but only one of them is Verified.

File creation - gives a signed, Verified commit

https://docs.github.com/en/rest/repos/contents?apiVersion=2022-11-28#create-or-update-file-contents

PUT /repos/{owner}/{repo}/contents/{path} 

tree 3d74577124f63a30306aa7ab33af71416897e6c8 parent fd324bf89ee00df729a5a1ff4022707e7ab2589e author play-git-hub-test-app[bot] <225534826+play-git-hub-test-app[bot]@users.noreply.github.com> 1764250194 +0000 committer GitHub <[email protected]> 1764250194 +0000 gpgsig -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJpKFJSCRC1aQ7uu5UhlAAAT5cQAHR5Q6gwcjA5POYPoN1ZMjt7 dCqtOUFanPcng0zL0nl8+RKBdcX3NlyCR9pfybcM1fXhlgUFbc8A0C0iwlwiw4df QxA5G1T1+uptEEEpIt2Ntpjfc+nUlJhEUgt3Mh03xlRKwzr5SIsd4qMa4RhxHSDI Rr20FxsOfc8RQREatA8GhLVyN43n204Y0O0PuhGgj00DEDrKXxSF0S0/9FXnQd7n RFmYrEbtmCIZS/+BuM2Kny5LBgyqF2VqaLXlheIbPfdk6gx9GEotPeSB/ZXXMUXl HCh0m89Icizs2DhOp5+FzCqq2PHIcQ3d7V03Wh/8FneXPdZmlVBT5h+/BNSN+1rV tHZsLOhuvpShbk2Tpfb1Y3V6iM6h5kAZSTDvUP37uZrjOEjJb/vi0TH//Hi3QoTp +4wNnT2w8I0BJRY8mJDhdhLQn++dGmlANCckJzPJYnNKzkUVYVr6zjnQP+6j8M1q oq+1MA1nc65FQ5/9JdmrFA+75JGpYyMKh2pJmAkWRzfhR8UPoQ3+xwEqjvPs0sww 1f7dlmiJ8DPhvbE5kFtULqSzMhenEOnOaSNl+jU/DIfUOkMWVAq//T36oRZF3nQm eM9rF8IuTjaxxIndZB9Rr4l3oxG5dsAqZzl5tPI2Fu34qx2bw2YUV1TLP0zfT0k5 nW6MOLC/k8/N6ot4WztI =MTFR -----END PGP SIGNATURE----- 

File deletion - not signed, commit does not show as Verified

https://docs.github.com/en/rest/repos/contents?apiVersion=2022-11-28#delete-a-file

DELETE /repos/{owner}/{repo}/contents/{path} 

As with file creation, neither author or committer were provided in the call to the GitHub API, but in this case the resulting commit uses the app as the committer, rather than committer GitHub <[email protected]>, and no gpgsig was generated:

tree 5fa3328d69d5dcd446577ffad5c943c2b4b6b7a8 parent 03dc7971bad7e7e96af708b9848e45fd2343446d author play-git-hub-test-app[bot] <225534826+play-git-hub-test-app[bot]@users.noreply.github.com> 1764250194 +0000 committer play-git-hub-test-app[bot] <225534826+play-git-hub-test-app[bot]@users.noreply.github.com> 1764250194 +0000 

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams.
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences.
• GitHub staff may reach out for further clarification or insight.
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[andrewpolemeni]

I'm facing this exact issue as well.