Unverified50% confidenceFactExact time
For CI bot accounts such as github-actions[bot], GitHub signs the automatically generated commits using its own hosted GPG key.
1
Sources
50%
Confidence
Long-term
Relevance
10/8/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedBoth SSH keys and GPG keys can be used to sign GitHub commits; GitHub binds public keys to accounts to associate code changes with contributor identities.76% similarVerifiedPlatforms such as GitHub Actions and GitLab CI grant runners write access to repositories by default through built-in credentials such as GITHUB_TOKEN.75% similarUnverifiedGitBot runs locally and uses the user's already-authenticated accounts and credentials, requiring no additional authentication setup.73% similarUnverifiedGitHub 已为 Dependabot 等官方自动化工具设置了 [bot] 标记，但第三方 AI 代理目前大多以普通用户账户的形式运作71% similarVerifiedVercel uses an automated release process in which releases are automatically triggered by github-actions, and commits are verified with GPG signatures.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/988641API
curl https://kongchang.com/api/v1/knowledge/claims/988641MCP
get_claim(id=988641)