Are you a customer of Octopus Deploy? Don't raise the issue here. Please contact our support team so we can triage your feature request, making sure it's handled appropriately.
Prerequisites
The enhancement
The Need
Customers who use Config-as-Code, Runbooks-as-Code, or GitOps-style Argo CD manifest commits often enforce GitHub branch protection rules that require signed, verified commits. Because Octopus wrote commits without a cryptographic signature, GitHub displayed them as Unverified — and on repositories with strict branch protection, Octopus-authored commits could be rejected outright. This forced customers to choose between enforcing verified-commit policies and using Octopus's Git-backed features.
Solution
Octopus Deploy can now sign the commits it makes to Git-backed projects with a GPG/PGP key, so they appear as Verified in GitHub.
- Administrators generate (or paste) a signing key pair and configure a committer identity at the system level.
- Once configured, every subsequent commit Octopus makes is signed with that key — both over the standard git protocol, and when committing via the GitHub API using username/password credentials.
- Commits made through a GitHub App connection already show as
Verified via GitHub's own signing, and are unaffected by this change.
- This is opt-in: instances that don't configure a signing key see no change in behaviour.
Known limitations (v1)
- Only GitHub's commit signature verification is covered by this round of work.
- SSH-based commit signing is not supported — only GPG/PGP keys.
- Signing keys are not automatically rotated; customers manage their own key/expiry lifecycle.
- The private key must not be passphrase-protected (there's no interactive prompt in the server runtime to supply one).
Links
Are you a customer of Octopus Deploy? Don't raise the issue here. Please contact our support team so we can triage your feature request, making sure it's handled appropriately.
Prerequisites
The enhancement
The Need
Customers who use Config-as-Code, Runbooks-as-Code, or GitOps-style Argo CD manifest commits often enforce GitHub branch protection rules that require signed, verified commits. Because Octopus wrote commits without a cryptographic signature, GitHub displayed them as
Unverified— and on repositories with strict branch protection, Octopus-authored commits could be rejected outright. This forced customers to choose between enforcing verified-commit policies and using Octopus's Git-backed features.Solution
Octopus Deploy can now sign the commits it makes to Git-backed projects with a GPG/PGP key, so they appear as
Verifiedin GitHub.Verifiedvia GitHub's own signing, and are unaffected by this change.Known limitations (v1)
Links