From ab32d44df09b922b2c9cf0099fafe36856dbb560 Mon Sep 17 00:00:00 2001 From: Erik Burton Date: Tue, 21 Jul 2026 20:02:40 -0700 Subject: [PATCH 1/2] fix: get-refs-from-pr-body disable github gpg key --- .changeset/nine-seahorses-wink.md | 6 ++++++ actions/get-refs-from-pr-body/src/sigscanner.ts | 1 + 2 files changed, 7 insertions(+) create mode 100644 .changeset/nine-seahorses-wink.md diff --git a/.changeset/nine-seahorses-wink.md b/.changeset/nine-seahorses-wink.md new file mode 100644 index 000000000..d6d89c3f9 --- /dev/null +++ b/.changeset/nine-seahorses-wink.md @@ -0,0 +1,6 @@ +--- +"get-refs-from-pr-body": minor +--- + +fix: set disable_gpg to true for sigscanner to ensure commit signatures are +hardware backed diff --git a/actions/get-refs-from-pr-body/src/sigscanner.ts b/actions/get-refs-from-pr-body/src/sigscanner.ts index bc820035e..5023e7a25 100644 --- a/actions/get-refs-from-pr-body/src/sigscanner.ts +++ b/actions/get-refs-from-pr-body/src/sigscanner.ts @@ -20,6 +20,7 @@ export async function verifyCommit( const params = new URLSearchParams({ commit: opts.sha, repository: opts.repository, + disable_gpg: "true", }); const target = `${opts.url}?${params.toString()}`; From 1f2dfccb1c48a5420d298dcbca2191689ad717a2 Mon Sep 17 00:00:00 2001 From: Erik Burton Date: Tue, 21 Jul 2026 20:05:33 -0700 Subject: [PATCH 2/2] fix: update dist --- actions/get-refs-from-pr-body/dist/index.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/actions/get-refs-from-pr-body/dist/index.js b/actions/get-refs-from-pr-body/dist/index.js index 8f35952de..4703c8eac 100644 --- a/actions/get-refs-from-pr-body/dist/index.js +++ b/actions/get-refs-from-pr-body/dist/index.js @@ -44351,7 +44351,8 @@ var core3 = __toESM(require_core()); async function verifyCommit(opts) { const params = new URLSearchParams({ commit: opts.sha, - repository: opts.repository + repository: opts.repository, + disable_gpg: "true" }); const target = `${opts.url}?${params.toString()}`; core3.debug(