How to make a verified commit in GHA with a GH App token?

[qrkourier]

I want my GHA robots to use a GH app token when they make a commit so it will appear "verified" in GH.com and satisfy the branch protection rule that all commits are from verified authors.

[gr2m]

If you create commits through the API, the commits are verified automatically. I just verified that creating a test with with my test app (https://github.com/apps/gr2m)
gr2m/sandbox@d893ef3

[qrkourier]

Will you clarify how you authenticated with the token? I guess you used this action to obtain a token from your app's ID and key. Then, perhaps you assigned the output value to some environment variable before executing git commit?

[gr2m]

I didn't use git commit. I used the https://docs.github.com/en/rest/repos/contents?apiVersion=2022-11-28#create-or-update-file-contents REST API

You can authenticate as an app for git commits as well, but I'm not sure how signing these commits work for apps in that flow.

[Amansaxena001]

creating blobs trees is complex may be there should be some straight forward way to do signed commits via github app