Signing commits via GitHub API's createCommitOnBranch

Hello,

My team is using Copybara to sync a private repo with a public one. This is working well, however we now have an organisational requirement for all Git commits to be signed. For various reasons, we cannot set up an SSH/GPG key on our build server, so the usual approach we take for bot commits is to commit via GitHub API's [createCommitOnBranch](https://docs.github.com/en/graphql/reference/commits#mutation-createcommitonbranch). This mutation pushes commits signed with GitHub's key.

Do you have any recommendations for how we could sign commits from Copybara given these constraints? For example, is there a way Copybara could directly commit using createCommitOnBranch? The alternative I'm exploring at the moment is to have a script recreate the commits from Copybara using createCommitOnBranch.

Many thanks

Start by reading Copybara's commit and push integration points alongside GitHub's GraphQL createCommitOnBranch documentation. The issue names no Copybara files or tests, so first determine whether this is an implementation request or a usage recommendation. Done means establishing whether Copybara can support signed commits under the stated constraints and documenting the resulting approach.

Written by the indexing model from the issue text.