Creating a signed tag using the REST API

[rustyhowell]

Select Topic Area

Question

Body

Is there a way to create a signed tag using the REST API?

Given a sha to a particular commit, how would I create a gpg-signed tag that points to that commit? I am thinking of something similar to git tag -a -m "This is a signed tag" mytag

https://docs.github.com/en/[email protected]/rest/git/commits?apiVersion=2022-11-28#create-a-commit
The documentation for creating a signed commit doesn't seem to work for me. https://stackoverflow.com/questions/64860478/creating-a-signed-commit-via-api I follow this SO post but still was unable to get it.

https://docs.github.com/en/[email protected]/rest/git/tags?apiVersion=2022-11-28
The doc for the git/tags/ endpoint shows that the POST response includes a verification block for the new tag, but there is no option to provide a signature as part of the payload to create a tag.

Any help would be appreciated. Thanks

[abelcheung]

I'm looking for this feature too (not specifically for GitHub Enterprise though). So far only REST API for git commits are automatically signed, while I have no luck doing the same with API endpoint for tags (which create annotated tags).

However there is a way if lightweight tag (i.e. git tag without -a, -s or -m option) is acceptable. If the commit on which the lightweight tag is anchored do have verified signature, then GitHub automatically shows the tag as verified. No REST API involved.

[finewiki]

Hello,

It is currently not possible to directly create a GPG-signed tag via the GitHub API. You can create a tag using the GitHub API documentation here, but there is no option to include a GPG signature in this process.

However, here are a couple of workarounds:

1. Create a Signed Tag Locally and Push to GitHub

After creating the tag via the API, you can sign it locally with GPG and then push it to GitHub. Here are the steps:

1. Create and Sign the Tag:

   git tag -a mytag -m "This is a signed tag" --sign

   This command will create the mytag tag with a GPG signature.

2. Push the Tag to GitHub:

   git push origin mytag

This way, your tag will be pushed to GitHub with the GPG signature.

2. Create the Tag via API and Sign Locally

Alternatively, you can use the GitHub API to create the tag without the GPG signature and then sign it locally. Here are the steps:

1. Create the Tag via API:
   You can create the tag through the GitHub API, but it won't have the GPG signature at this point.

2. Sign the Tag Locally:
   After creating the tag, you can sign it locally using GPG and then push it to GitHub:

   git push origin mytag