Re-create backport commits via the Git Data API so they are verified - #502
Merged
Merged
Conversation
main, release-0.14 and release-0.15 require signed commits, but the cherry-pick workflow pushes backport commits with git push from the runner, which never signs them. Every open backport PR to release-0.15 (#496 through #499) is currently blocked on an unsigned commit. After the push, re-create each new commit on the backport branch through the Git Data API, chaining from the target branch head, and force-point the backport branch at the new tip. GitHub signs commits created this way, so the chain shows as "Verified" without managing a GPG or SSH key for the bot. The initial push is kept because the API needs the tree objects to exist in the repository before the commits can be created. The re-created commits are authored by github-actions[bot]; the original commit stays referenced through the cherry-pick trailer. Ported from NVIDIA/nvidia-container-toolkit#2012. Signed-off-by: Rajath Agasthya <ragasthya@nvidia.com>
cdesiniotis
approved these changes
Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
main, release-0.14 and release-0.15 require signed commits, but the cherry-pick workflow pushes backport commits with
git pushfrom the runner, which never signs them. Every open backport PR to release-0.15 (#496 through #499) is currently blocked on an unsigned commit.After the push, re-create each new commit on the backport branch through the Git Data API, chaining from the target branch head, and force-point the backport branch at the new tip. GitHub signs commits created this way, so the chain shows as "Verified" without managing a GPG or SSH key for the bot. The initial push is kept because the API needs the tree objects to exist in the repository before the commits can be created. The re-created commits are authored by github-actions[bot]; the original commit stays referenced through the cherry-pick trailer.
Ported from NVIDIA/nvidia-container-toolkit#2012. Backport PRs opened in that repo since the change merged (for example NVIDIA/nvidia-container-toolkit#2092 through #2096) carry verified commits.