How do I create signed commits for AI coding agents like Copilot to ensure accountability?

Verdict: You do not need to sign Copilot's commits. GitHub already signs commits from Copilot cloud agent. For other agents that run git on your machine, you must set up signing yourself, and a dedicated key per agent is the right model.

1. Copilot cloud agent: already signed

• GitHub states that Copilot cloud agent's commits "are signed, so they appear as 'Verified' on GitHub." It also says they are authored by Copilot, with the requester marked as co-author (Risks and mitigations).
• Each commit message links to the session log. Use that link to trace why a change was made (Managing agent sessions).
• Accountability controls still apply. Only users with write access can trigger the agent. Its draft pull requests need a human to merge them (Risks and mitigations).

2. Other local agents: sign with a dedicated key

Do not reuse your personal signing key for an agent. A signature from your key makes the agent's work look like yours. Use these steps:

1. Create an SSH or GPG key for the agent. SSH is the simplest option. SSH signing needs Git 2.34 or later (About commit signature verification).
2. Add the public key to the GitHub account as a signing key. There is no limit on the number of signing keys (About commit signature verification).
3. Tell Git about the key. Follow Telling Git about your signing key.
4. Turn on signing for the agent's repository. Run git config commit.gpgsign true (Signing commits).

Caution: the signature proves which key signed the commit. It does not prove which agent or human started the run.

3. GitHub App: bot-verified commits

Organizations and GitHub Apps that require commit signing can use bots to sign commits. GitHub verifies these signatures only if:

• The request is authenticated as the GitHub App or bot.
• The request has no custom author, committer, or signature information. The Commits API is one example (About commit signature verification).

A local git commit -S followed by git push does not meet these conditions. Use the App route if you need bot-verified commits from an agent.

4. Enforce signing on the branch

• Enable Require signed commits on a protected branch. Contributors and bots can then push only signed, verified commits (About protected branches).
• Squash merges can fail this check. GitHub checks the test merge commit, so unsigned commits on the head branch can block a squash merge (About protected branches).
• Rebase and merge creates commits that GitHub cannot sign for the user. Rebase locally and push the signed result instead (About commit signature verification).

5. Key rotation does not remove past verification

Verified commits keep their status after a key is revoked or expires. GitHub stores a verification record when the commit is first verified (About commit signature verification). Plan key rotation with this in mind.

How they relate

Copilot cloud agent signs with GitHub's own identity. Local agents sign with a key you own. A GitHub App sits between them. It can sign as a bot, but only through the authenticated API path.

Recommendation: Trust Copilot cloud agent's built-in signing for its own commits. For local agents, create one signing key per agent and require signed commits on protected branches.

• Choose the Copilot path if your agent work runs in GitHub's cloud agent.
• Choose a dedicated SSH key if a local agent runs git commit on your machine.
• Choose a GitHub App if you need the commits to show as verified bot output.

If you run several local agents, you also need to trace each commit to one agent run and one accountable human. githug does this. Each agent gets its own key, which mints GitHub tokens that last one hour and work on one repo. Agent commits are authored as the agent and carry trailers naming the accountable human, the agent, and the run. The hug CLI (hug init --repo owner/repo) sets this up for Claude Code, Codex, Cursor, or any agent that runs git. It is free during the beta.