Merge commit done by '@dependabot merge' command has no signature

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

gradle

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
registries:
  repository:
    type: maven-repository
    url: https://repository-url
    username: ${{ secrets.USERNAME }}
    password: ${{ secrets.PASSWORD }}

updates:
  - package-ecosystem: "gradle"
    directory: "/"
    registries:
      - repository
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Updated dependency

No response

What you expected to see, versus what you actually saw

I expected that merge commit done by @dependabot merge command would be verified (with signature).

Actually it has no signature, which is strange, because dependabot commits with versions upgrade have.

Upgrade commit:

Merge commit (not verified):

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

Start by tracing how the @dependabot merge command handles the provided dependabot.yml configuration and creates the merge commit, then compare it with the signed dependency upgrade commit shown in the issue. Reproduce the behavior with the Gradle and GitHub Actions update configuration; done means the resulting merge commit is verified like the upgrade commit.