commit-action

action.yaml

commit-action is a GitHub Action to push changes to remote branches by GitHub API. You can create verified commits using GitHub App.

Blog posts

• 2025-02-15 GitHub Actions で Verified Commit でコードを自動修正
• 2025-02-15 Fix Code Via GitHub Actions By Verified Commits

Why Use commit-action?

Unlike similar actions, commit-action creates and pushes commits by GitHub API instead of Git commands. So you can create verified commits using GitHub Actions token ${{github.token}} or a GitHub App installation access token.

Commit signing is so important for security.

https://docs.github.com/en/authentication/managing-commit-signature-verification

To create verified commits using Git, a GPG key or SSH key is required. It's bothersome to manage GPG keys and SSH keys properly for automation, so it's awesome that commit-action can create verified commits without them.

GitHub Access Token

You can use the following things:

• :thumbsup: GitHub App Installation access token: We recommend this
• :thumbsdown: GitHub Personal Access Token: This can't create verified commits
• :thumbsdown: ${{secrets.GITHUB_TOKEN}}: This can't trigger new workflow runs.

https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow

When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN, with the exception of workflow_dispatch and repository_dispatch, will not create a new workflow run.

Required permissions

contents:write is required. Furthermore, if you want to fix workflow files, workflows:write is also required.

How To Use

commit-action is so easy to use. All inputs are optional.

You only need to run commit-action after fixing code in workflows. Then it creates and pushes a commit to a remote branch.

name: Example
on:
  pull_request: {}
jobs:
  example:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Fix files
      # ...

      - name: Push changes to the remote branch
        uses: suzuki-shunsuke/commit-action@06e3b49d4706498d325d29bd85adc82ecf2f5d8f # v1.0.0

commit-action fails if it pushes a commit to ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} in $GITHUB_REPOSITORY. If you want to continue without failing, set fail_on_self_push: false and check outputs instead (see self_push). If no change is pushed, commit-action does nothing and exits successfully.

branch, repository

By default, commit-action pushes a commit to ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} in $GITHUB_REPOSITORY, but you can change them.

- uses: suzuki-shunsuke/commit-action@06e3b49d4706498d325d29bd85adc82ecf2f5d8f # v1.0.0
  with:
    branch: foo
    repository: suzuki-shunsuke/tfcmt

parent branch

If a new branch is created, the parent branch is the default branch by default. You can specify the paretn branch.

- uses: suzuki-shunsuke/commit-action@06e3b49d4706498d325d29bd85adc82ecf2f5d8f # v1.0.0
  with:
    branch: foo-2
    parent_branch: foo

GitHub Access token

${{github.token}} is used by default, but we don't recommend it because ${{github.token}} doesn't trigger a new workflow run. We recommend GitHub App installation access tokens. You can create a GitHub App installation access token and pass it to commit-action yourself, but you can also pass a pair of GitHub App ID and private key. Then commit-action creates a GitHub App installation access token with minimum repositories and permissions.

- uses: suzuki-shunsuke/commit-action@06e3b49d4706498d325d29bd85adc82ecf2f5d8f # v1.0.0
  with:
    app_id: ${{secrets.APP_ID}}
    app_private_key: ${{secrets.APP_PRIVATE_KEY}}

Which Files To Be Committed

By default, commit-action lists all added, modified, and deleted files by git ls-files --modified --others --exclude-standard in root_dir (The default is .). The input files is used as arguments of git ls-files. If the input list_files_by_git is set to false (the default is true), the action uses the input files as files to be committed without git ls-files. The repository needs to be checked out before using commit-action unless list_files_by_git is set to false. The input files is a list of relative paths from root_dir.

e.g.

- uses: suzuki-shunsuke/commit-action@06e3b49d4706498d325d29bd85adc82ecf2f5d8f # v1.0.0
  with:
    files: |
      README.md
      package-lock.json

fail_on_self_push

#204 By default, commit-action fails when a commit is pushed to the same repo and branch as the current workflow run. When the input fail_on_self_push is set to false (the default is true), the action succeeds in this case.

- uses: suzuki-shunsuke/commit-action@06e3b49d4706498d325d29bd85adc82ecf2f5d8f # v1.0.0
  with:
    fail_on_self_push: false # continue without failing when self-pushing

Outputs

• pushed: true if a commit was pushed.
• sha: the pushed commit SHA (empty if none).
• self_push: true if a commit was pushed to the same repo/branch as the current workflow run.

Fix workflow files

If you want to fix workflow files, the permission workflows:write is required. The input workflow changes the behaviour when workflow files are changed. The input is used if app_id and app_private_key are passed. The following values are available:

1. allow (default) - Grant workflows:write permission when issuing an access token
2. deny - Fail if workflow files are changed
3. ignore - Ignore workflow files

- uses: suzuki-shunsuke/commit-action@06e3b49d4706498d325d29bd85adc82ecf2f5d8f # v1.0.0
  with:
    workflow: ignore # allow (default), deny

Available versions

commit-action's main branch and feature branches don't work. Please see the document.