Allow unsigned PR branch pushes when signed commits are disabled

[Copilot]

Bug Fix

What was the bug?

push-to-pull-request-branch could not push local merge commits: GraphQL signed commits cannot represent multiple parents, and the documented push-signed-commits: false escape hatch was not implemented.

How did you fix it?

• Workflow configuration

  • Added push-signed-commits to the push-to-pull-request-branch schema and compiler config.
  • Plumbed the option into the safe-output handler as push_signed_commits.

• Push behavior

  • When push-signed-commits: false, skip GraphQL replay and use authenticated git push directly.
  • Preserve existing default behavior: signed GraphQL commits remain enabled unless explicitly disabled.

• Docs and release notes

  • Documented the option in safe-output references.
  • Added a patch changeset.

safe-outputs:
  push-to-pull-request-branch:
    push-signed-commits: false

[pelikhan]

@copilot

• rename field to signed-commits
• signed-commits:true means signed-commits are required
• apply field to create-pull-request as well

[Copilot]

Pull request overview

Adds a push-signed-commits option to push-to-pull-request-branch so users can opt out of GraphQL signed commits and push directly with git push, which allows merge commits (multiple parents) that the GraphQL createCommitOnBranch mutation cannot represent.

Changes:

• Added push-signed-commits config option to schema, Go config struct, parser, and handler builder; plumbed as push_signed_commits to the JS handler.
• In push_signed_commits.cjs, when signedCommits === false, skip GraphQL replay and run git push origin <branch> directly, returning the local HEAD SHA.
• Updated docs and added tests + changeset.

Show a summary per file

File	Description
pkg/workflow/push_to_pull_request_branch.go	Adds PushSignedCommits field and parsing.
pkg/workflow/push_to_pull_request_branch_test.go	Test that push-signed-commits: false reaches the handler config.
pkg/workflow/compiler_safe_outputs_handlers.go	Emits push_signed_commits in handler config JSON.
pkg/parser/schemas/main_workflow_schema.json	Schema entry for the new option.
docs/src/content/docs/reference/safe-outputs.md	Mentions option in safe-outputs reference.
docs/src/content/docs/reference/safe-outputs-pull-requests.md	Documents option for push-to-pull-request-branch.
actions/setup/js/types/handler-factory.d.ts	Declares push_signed_commits in HandlerConfig.
actions/setup/js/push_to_pull_request_branch.cjs	Reads option and forwards signedCommits to helper.
actions/setup/js/push_to_pull_request_branch.test.cjs	Test for option log line.
actions/setup/js/push_signed_commits.cjs	Direct git push branch when signedCommits === false.
actions/setup/js/push_signed_commits.test.cjs	Integration test for merge-commit push with signed commits disabled.
.changeset/patch-push-signed-commits-opt-out.md	Patch changeset note.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 11/12 changed files
• Comments generated: 0

[Copilot]

@copilot

• rename field to signed-commits...

Addressed in 1256302 with a follow-up cleanup in b40bd5d. The option is now signed-commits, defaults to required signed commits, and applies to both create-pull-request and push-to-pull-request-branch.

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Merged origin/main in 21922b1 and recompiled workflows in 584be01.

[pelikhan]

@copilot review all changes, apply SOLID

[Copilot]

@copilot review all changes, apply SOLID

Reviewed the PR changes for SOLID/design concerns and applied the cleanup in 73b13b0. The unsigned push path now exits before GraphQL-only rev-list work and shares direct push/HEAD resolution logic. Targeted JS and Go tests passed.

[pelikhan]

@copilot lint js

https://github.com/github/gh-aw/actions/runs/25902317206/job/76128202342#step:6:1

[Copilot]

@copilot lint js

https://github.com/github/gh-aw/actions/runs/25902317206/job/76128202342#step:6:1

Fixed in a39a17c. make lint-cjs now passes, and the JS test suite/typecheck passes as well.

[github-actions]

@copilot please summarize remaining blockers and propose next steps. (pr-sous-chef run: https://github.com/github/gh-aw/actions/runs/25913427032)

Generated by 👨‍🍳 PR Sous Chef · ◷

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Merged latest origin/main in 5637a74 and ran make recompile; it completed without producing additional changes. make lint-cjs and the JS test suite/typecheck pass.