# IMPORTANT: github.com/ansible now requires signed commits **URL:** \ **Category:** Project Discussions\ **Tags:** infra-and-security, community-wg\ **Created:** [March 13, 2026, 12:40pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520 "2026-03-13T12:40:23Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![gundalow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gundalow/32/99_2.png) [@gundalow](https://forum.ansible.com/u/gundalow)\ **Post date:** [March 13, 2026, 12:40pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/1 "2026-03-13T12:40:23Z")
# Overview From **Monday 16th March** we will be requiring Git signed commits for all repos under [github.com/ansible/](https://github.com/ansible/). Red Hat is continually looking at improving the supply chain, so expect further improvements as Ansible adopts more of the [Cyber Resilience Act (CRA)](https://www.redhat.com/en/red-hat-eu-cyber-resilience-act), updates will be shared in the Ansible Forum under the [infra-and-security tag](https://forum.ansible.com/tag/infra-and-security/492). # FAQ ## How do I setup Git Signed Commits? You can use either GPG or your existing SSH key to sign commits: - [GPG instructions](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#gpg-commit-signature-verification). - [SSH key instructions](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#ssh-commit-signature-verification). At a high level: 1. [Instruct git to sign commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key) (you can use GPG or your [existing SSH key](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-ssh-key)) 2. [Add your signing key to GitHub](https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account) 3. Ensure your [GitHub Settings](https://github.com/settings/keys) lists your “Signing keys” ## How do I update an existing open PR? Note that all commits must be signed, not just the most recent commit in a branch. To sign all commits in your feature branch, which was created from devel: ```auto git rebase --exec 'git commit --amend --no-edit -S' -i devel git push -f origin my-feature-branch1 ``` Or if the default branch is main use: ```auto git rebase --exec 'git commit --amend --no-edit -S' -i main git push -f origin my-feature-branch1 ``` ## What about the other GitHub organisations, such as ansible-collections and ansible-community? We will roll this improvement to the other Ansible related GitHub organizations soon, so please make the time to setup signed commits to avoid needing to rebase existing PRs in the future. ## What other improvements are likely? The [Cyber Resilience Act (CRA)](https://www.redhat.com/en/red-hat-eu-cyber-resilience-act) is giving us a chance to review our existing processes. Expect improvements to: - GitHub Rulesets to protect branches and require PR reviews - Improved documentation, such as SECURITY.md - etc Updates will be posted to #infra-and-security ---
**Author:** ![gundalow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gundalow/32/99_2.png) [@gundalow](https://forum.ansible.com/u/gundalow)\ **Post date:** [March 16, 2026, 1:18pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/2 "2026-03-16T13:18:56Z")
The initial improvements to the Ansible GitHub Org is now live. ---
**Author:** ![webknjaz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/webknjaz/32/5183_2.png) [@webknjaz](https://forum.ansible.com/u/webknjaz)\ **Post date:** [March 16, 2026, 2:27pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/3 "2026-03-16T14:27:02Z")
Ouch.. Looks like we just got hit by this — it broke a part of the (post-)release process in `ansible/pylibssh` ☹ There’s a changelog generation commit that is made during an automated release in a separate branch as a part of the CI/CD pipeline (behind a human approval of the , of course). That commit gets tagged and corresponds to the released artifact. This is in the release branch that also gets a PR open. After the pipeline completes, it’s required that the branch is merged using the “natural” method (not fake “merges” like rebase or squash) — this means that the individual commits of that branch would become a part of the main development branch. Including the tagged commit (so the tag will “belong” to `devel` in the end). This is mandatory to make the Git-based version computation work correctly, meaning that until it’s figured out, it’ll block any development in the project (well, we won’t be merging any PRs at least). ---
**Author:** ![gundalow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gundalow/32/99_2.png) [@gundalow](https://forum.ansible.com/u/gundalow)\ **Post date:** [March 16, 2026, 2:48pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/4 "2026-03-16T14:48:26Z")
> [@webknjaz](#): > > Ouch.. Looks like we just got hit by this — it broke a part of the (post-)release process in `ansible/pylibssh` ☹ @webknjaz Thanks for reporting this, sorry we broke your workflow. I’m not familar with the workflow we have on `pylibssh` though some options could include: - Only restricting the default branch (though if it’s [#828](https://github.com/ansible/pylibssh/pull/828), then looks like you are merging into devel) - Add an allow for this specific bot user (though unsure if we can rename the account) ---
**Author:** ![webknjaz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/webknjaz/32/5183_2.png) [@webknjaz](https://forum.ansible.com/u/webknjaz)\ **Post date:** [March 16, 2026, 3:13pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/5 "2026-03-16T15:13:56Z")
> [@gundalow](#): > > - Only restricting the default branch (though if it’s [#828](https://github.com/ansible/pylibssh/pull/828), then looks like you are merging into devel) Yep, the new ruleset only applies to the default branch. Basically, when you `git merge` one branch into the other, two chains of (kinda parallel) commits become a part of that target branch. GitHub _sees_ this as pushing those individual commits from the incoming branch into `devel`. Said commits are made in the CI environment with the GitHub Actions user as the commit author, pushed into the branch via `GITHUB_TOKEN` GHA provisions (though, ther auth bit is irrelevant here). These commits are unsigned and so merging them in is seen as “pushing unsigned commits into `devel` (the default branch)”, which ends up rejecting the push. > [@gundalow](#): > > - Add an allow for this specific bot user (though unsure if we can rename the account) There’s not “user”. The commit metadata lists whatever author you tell Git to put in there. The metadata fields (and contents) are basically arbitrary strings. In order to sign the commits, we’d need an actual user, I imagine (I wonder if OIDC would be helpful here, though). And we’d need to set that user email as the committer/author, plus in addition to that, sign the commit. This means stuffing the user’s private signing key into the repo secrets (if it doesn’t fit into a secret, then maybe committing an encrypted key, like the the times of Travis CI, and only putting the decryption key into the secrets). * * * It looks like it may take some time to figure out how to move forward long term. Right now, we have a project with a half-complete release process that cannot move forward until a proper merge happens. And force-pushing the branch with signed commits isn’t an option because the tag will keep pointing to the unsigned commit and tags are supposed to be immutable, not force-pushed to point to new commits on a whim. So short term, we’ll need to somehow disable this blocker to get the PR in. Like maybe coordinate it for a few minutes and re-enable. ---
**Author:** ![webknjaz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/webknjaz/32/5183_2.png) [@webknjaz](https://forum.ansible.com/u/webknjaz)\ **Post date:** [March 16, 2026, 3:50pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/6 "2026-03-16T15:50:32Z")
_UPD:_ the problem’s got solved somehow. ~~@gundalow did you change the configuration or was it the fact that I initialted merging from the GitHub UI rather than command-line locally?~~ Looks like @sivel helped with that. ---
**Author:** ![markuman](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@markuman](https://forum.ansible.com/u/markuman)\ **Post date:** [March 16, 2026, 8:34pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/7 "2026-03-16T20:34:25Z")
eh, I used my ed25519 ssh key for years to sign my git commits. GitLab, gitea, forgejo …are all fine with that #### gitea 🙂 ![image](https://us1.discourse-cdn.com/ansible/original/2X/a/af90b88a5dd6d838c3aa3ef4ceafc06b503a6797.png) #### gitlab 🙂 ![image](https://us1.discourse-cdn.com/ansible/original/2X/0/04b41b034bdac02b40191af1ccf6fc6b46b60411.png) just microsoft/github is not able to implement or vibecode this feature with their AI … #### github ☹ ![image](https://us1.discourse-cdn.com/ansible/original/2X/3/3823591d782320140ee4d9182c413adcfd369ac4.png) I’m not amused to maintain a second key, just for sign commits on github. ---
**Author:** ![mattclay](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mattclay/32/268_2.png) [@mattclay](https://forum.ansible.com/u/mattclay)\ **Post date:** [March 16, 2026, 8:48pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/8 "2026-03-16T20:48:20Z")
@markuman Have you verified your SSH key is configured on GitHub as a signing key, not just an authentication key? ---
**Author:** ![markuman](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@markuman](https://forum.ansible.com/u/markuman)\ **Post date:** [March 16, 2026, 9:08pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/9 "2026-03-16T21:08:15Z")
Eh? You must add the key a 2nd time as signing key? and there is no verification step? On Gitea, you get a verification step to proof that you’re also the owner of the private key ![image](https://us1.discourse-cdn.com/ansible/original/2X/2/207f540575b10670ad3138ba8fb15929802eef13.png) ---
**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\ **Post date:** [March 16, 2026, 10:01pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/10 "2026-03-16T22:01:59Z")
~no, I was able to make my existing keys ‘also’ signing keys, no need to re upload~ nevermind, i swear this worked for me at one point, but seems it isn’t there anymore (or i just dreamed it). ---
**Author:** ![webknjaz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/webknjaz/32/5183_2.png) [@webknjaz](https://forum.ansible.com/u/webknjaz)\ **Post date:** [March 23, 2026, 3:51pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/11 "2026-03-23T15:51:32Z")
@gundalow another broken use case I’ve hit in `ansible/awx-plugins` and `ansible/awx_plugins.interfaces` is generating lock files in CI (avoiding third party services) and submitting a PR with unsigned commits (with human approval). ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [March 23, 2026, 6:27pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/12 "2026-03-23T18:27:21Z")
@webknjaz ansible/ansible-documentation has a similar problem. There’s currently a PR to fix this: [use github-app-commit-action to create signed verified commits by oraNod · Pull Request #3543 · ansible/ansible-documentation · GitHub](https://github.com/ansible/ansible-documentation/pull/3543) The PR uses [GitHub - dsanders11/github-app-commit-action: GitHub Action which makes it simple to make verified Git commits as a GitHub app · GitHub](https://github.com/dsanders11/github-app-commit-action), which I’m a bit skeptical about, I’d rather hope there’s an official GitHub action for something this sensitive, instead of one provided by a “random person” (even though that random person seems to work for Microsoft). ---
**Author:** ![webknjaz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/webknjaz/32/5183_2.png) [@webknjaz](https://forum.ansible.com/u/webknjaz)\ **Post date:** [March 24, 2026, 12:42pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/13 "2026-03-24T12:42:56Z")
Right.. I was expecting that to happen in the docs repo but haven’t been watching it closely lately so didn’t really check. Not sure I like sticking secrets into GHA envs either. I’ll have to spend some time tinkering but one seemingly usable idea would be relying on OIDC, I imagine. This would require having a GH App deployed, of course. ---
**Author:** ![gundalow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gundalow/32/99_2.png) [@gundalow](https://forum.ansible.com/u/gundalow)\ **Post date:** [March 24, 2026, 3:51pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/14 "2026-03-24T15:51:37Z")
Hi folks, I appreciate all the feedback, there are clearly more edge cases than we realised, so please do continue to share specific feedback so we can make targeted improvements. We do not want to make contributing to Ansible more difficult than it needs to be. We won’t be required signed commits on the ansible-community & ansible-collection orgs at this time. We have the ability to enable this requirement on a per-repo level, which is something we might consider. ---
**Author:** ![webknjaz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/webknjaz/32/5183_2.png) [@webknjaz](https://forum.ansible.com/u/webknjaz)\ **Post date:** [March 24, 2026, 6:18pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520/15 "2026-03-24T18:18:52Z")
Just realized that anything using my Patchback bot is going to be affected too. I’ve been meaning to look into implementing signing in there but it was never a top priority but rather a fancy thing to experiment with. In fact, the tracking issue is the very first one in the bot repo, filed 5+ years ago. Not sure when I’ll get to it but [How to Use Commit Signing with GitHub Apps · community · Discussion #50055 · GitHub](https://github.com/orgs/community/discussions/50055#discussioncomment-13460641) seems to even go over hacking silly limitations of GH API.