Automated GitHub App commit signing

[dat-intellis]

At the moment it isn't possible to get automated commit signing purely using the GitHub App,

• which means we will need to establish a dedicated organization member,
• which in turn results in increased cost for the additional user.

The entire conversation from slack can be found at the following link:

• Slack Conversation Thread: https://cloud-native.slack.com/archives/CLAJ40HV3/p1744284898048549

Screenshot of conversation:

[plockaby-ionq]

I can confirm that the only way to get GitHub to automatically sign things committed by a GitHub App user is to use their API. I found this comment on this gist to be immensely helpful in getting my own pipelines to do this so maybe it'd be helpful in getting the image automation controller to do this: https://gist.github.com/swinton/03e84635b45c78353b1f71e41007fc7c?permalink_comment_id=5401086#gistcomment-5401086

Getting verified commits would be very very nice and keep me from having to override merge PRs.

[ponkio-o]

We face the exact same issue. Due to organizational policy, we want to enforce signed commits, but this constraint prevents us from achieving it.
We know it's possible by adding machine accounts (i.e., regular users) to the organization, but for licensing and security reasons, we prefer to use GitHub Apps token.

[matheuscscp]

One way I can think to implement this feature that is consistent with all our provider features across all Flux APIs is by introducing the field .spec.git.commit.signingKey.provider with the values generic (the default) for PGP keys, and github for GitHub App. Then if github is set we look up .spec.git.commit.signingKey.secretRef expecting it to be GitHub App creds and use them to call the GitHub Commit API. I'm not sure about the specifics but this API call could be implemented here:

https://github.com/fluxcd/pkg/blob/main/git/github/client.go

And later used in image-automation-controller. I don't have time to work on this myself right now, but I'd be happy to review PRs if anybody here had the time.