git verify-commit: Usage, Options & Common CI Errors

By Kaveh Alemi·Latchkey

git verify-commit checks whether a commit carries a valid, trusted signature.

Pipelines that require signed commits use verify-commit as the gate. Its exit code is the contract: zero means a good signature, non-zero means missing, bad, or untrusted.

What it does

git verify-commit checks the cryptographic signature attached to a commit against your configured GPG or SSH keyring and reports validity, exiting non-zero if the signature is absent or cannot be trusted.

Common usage

git verify-commit HEAD
git verify-commit -v <sha>
git verify-commit --raw <sha>
git log --show-signature -1

Options

Common errors in CI

error: <sha>: no signature found exits non-zero - the commit is simply unsigned. "gpg: Can’t check signature: No public key" means the signer’s key is not imported on the runner; import the allowed keys first. Trust matters: a valid signature from an unknown key still fails the gate.

Using this in CI

CI checkouts are shallow and detached by default, which changes the answer this command gives you. Commands that read history, branch names, or tags need the checkout configured for it.

- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # history, tags, and git describe all need this

- run: |
    git rev-parse --is-shallow-repository   # expect false
    git rev-parse --abbrev-ref HEAD          # prints HEAD when detached

Frequently asked questions

Related guides

References

• GitHub Actions documentation