Github "Rebase & Merge" button problem

Every PR and all commit using gpgsign when click “Rebase & Merge”,
why gpgsign not appear?

1 Like

Hi @totoprayogo1916 could you please list all steps to reproduce this issue?
What was your expected outcome here also?

Example (live):

This PR (Pull Request #1) is signed, but after clicking the button “Rebase and Merge”, on the target branch the signature is lost.
See history· totoprayogo1916/GIT-test (github.com)

Thank you for that additional context.

Most commits made directly on GitHub are signed by our @web-flow user. When you create a commit on github.com (web-edit, merge, revert, etc…), we say that you are the author and @web-flow is the committer. The only place where this gets messed up is with squashes/rebases where two GitHub users were involved. If you wrote the commits and I am squashing them, we say that you are the author and I am the committer. In this case there’s no place to annotate that @web-flow was involved with the commit.

When it comes to signed commits, it is always the committer that makes the signature. This is why it works for us to sign using @web-flow’s key for most web commits. With squashes involving two GitHub users though, @web-flow is not the committer, so we cannot sign the commit.

Going forward, choosing the squash merge option would sign the commit, as long as the author is the same person merging the pull request.