How does GitHub's 'Require signed commits' branch protection rule work?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Signed commits are cryptographic proof that the commit actually came from you. When you enable this branch protection, GitHub checks every commit for a valid GPG, SSH, or S/MIME signature — unsigned commits get rejected at push.
Full explanation below image
Full Explanation
The 'Require signed commits' branch protection rule forces all commits pushed to the protected branch to have cryptographic signature verification. Developers must configure their Git client to sign commits using GPG keys, SSH keys (with allowed signers configuration), or S/MIME certificates, with the corresponding public key registered in their GitHub account. GitHub then verifies the signature on each push, and unsigned or unverifiable commits are rejected. This prevents commit author spoofing — without signing, anyone with push access could attribute commits to any email address. It does NOT relate to commit message text, 2FA (which is account-level, not per-push), or CI checks.