[DEVREL-144] Use GitHub API for verified bot commits

Author: suever

.github/workflows/sync-openapi.yml

@@ -73,31 +73,40 @@ jobs:
             git diff --cached --stat | tail -25
           fi
 
-      # Resolve the GitHub App's bot user identity for commit authorship.
-      - name: Get GitHub App bot identity
-        if: steps.diff.outputs.changed == 'true'
-        id: bot-identity
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
-        run: |
-          user_id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
-          echo "name=${APP_SLUG}[bot]" >> "$GITHUB_OUTPUT"
-          echo "email=${user_id}+${APP_SLUG}[bot]@users.noreply.github.com" >> "$GITHUB_OUTPUT"
-
       # A unique branch per run (date + run id) so every sync opens a brand-new
-      # PR and never reuses/updates a previous one.
+      # PR and never reuses/updates a previous one. The commit is created through
+      # the Git Data API so GitHub marks it as verified without needing a GPG key.
       - name: Commit and push
         if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          git config user.name "${{ steps.bot-identity.outputs.name }}"
-          git config user.email "${{ steps.bot-identity.outputs.email }}"
           BRANCH="bot/openapi-sync-$(date -u +'%Y-%m-%d')-${GITHUB_RUN_ID}"
           echo "BRANCH=$BRANCH" >> "$GITHUB_ENV"
+
+          # Local commit to package the tree and push objects to GitHub.
+          git config user.name "bot"
+          git config user.email "bot@noreply"
           git checkout -B "$BRANCH"
           git commit -m "Sync client-go with OpenAPI spec"
           git push origin "$BRANCH"
 
+          # Re-create the commit through the API so GitHub marks it as verified.
+          TREE=$(git rev-parse HEAD^{tree})
+          PARENT=$(git rev-parse HEAD~1)
+          VERIFIED_SHA=$(gh api "repos/${{ github.repository }}/git/commits" \
+            --method POST \
+            -f message="Sync client-go with OpenAPI spec" \
+            -f tree="$TREE" \
+            -f "parents[]=$PARENT" \
+            --jq .sha)
+
+          # Point the branch at the verified commit.
+          gh api "repos/${{ github.repository }}/git/refs/heads/$BRANCH" \
+            --method PATCH \
+            -f sha="$VERIFIED_SHA" \
+            -f force=true
+
       - name: Open PR
         if: steps.diff.outputs.changed == 'true'
         id: pr

.github/workflows/test-app-commit.yml

@@ -25,21 +25,31 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 
-      - name: Get GitHub App bot identity
-        id: bot-identity
+      - name: Make verified test commit
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
         run: |
-          user_id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
-          echo "name=${APP_SLUG}[bot]" >> "$GITHUB_OUTPUT"
-          echo "email=${user_id}+${APP_SLUG}[bot]@users.noreply.github.com" >> "$GITHUB_OUTPUT"
-
-      - name: Make test commit
-        run: |
-          git config user.name "${{ steps.bot-identity.outputs.name }}"
-          git config user.email "${{ steps.bot-identity.outputs.email }}"
+          # Local commit to package the tree and push objects to GitHub.
+          git config user.name "bot"
+          git config user.email "bot@noreply"
           echo "# Test commit — safe to delete" > .test-app-commit
           git add .test-app-commit
           git commit -m "test: verify GitHub App commit shows as Verified"
           git push
+
+          # Re-create the commit through the API so GitHub marks it as verified.
+          TREE=$(git rev-parse HEAD^{tree})
+          PARENT=$(git rev-parse HEAD~1)
+          VERIFIED_SHA=$(gh api "repos/${{ github.repository }}/git/commits" \
+            --method POST \
+            -f message="test: verify GitHub App commit shows as Verified" \
+            -f tree="$TREE" \
+            -f "parents[]=$PARENT" \
+            --jq .sha)
+
+          # Point the branch at the verified commit.
+          BRANCH=$(git rev-parse --abbrev-ref HEAD)
+          gh api "repos/${{ github.repository }}/git/refs/heads/$BRANCH" \
+            --method PATCH \
+            -f sha="$VERIFIED_SHA" \
+            -f force=true