Background
When "Vigilant Mode" is enabled and a commit is made in github.com, the commit is marked unverified/unsigned and everyone can see it (not just users with vigilant mode enabled). This is a problem because some repos only allow signed commits, but only users with "Vigilant Mode" enabled are blocked (specifically when the commit originates from github.com).
Is there a way to sign commits that originate from github.com?
Repo Steps
How to enable "Vigilant Mode:
- github
- profile icon
- settings
- SSH and GPG Keys
- Enable "Vigilant Mode" checkbox
How to see an unverified commit:
- Open an already merged PR
- Click the "revert" button near the bottom
- Create a draft PR
- Open the "commits" tab