How to Enable Verified Commits and Tags in GitHub Codespaces Using SSH

✅ How to Enable Verified Commits and Tags in GitHub Codespaces Using SSH

If you're using GitHub Codespaces and want your commits and tags to display the green "✅ Verified" badge on GitHub, you’ll need to set up SSH signing manually. By default, Codespaces do not sign commits or tags — but with a few steps, you can make every change cryptographically verified.

In this guide, you’ll learn:

• Why commit/tag verification matters

• How to set up SSH signing in Codespaces

• How to automate the setup with a setup.sh script

• How to verify your setup is working

Why Use Verified Commits and Tags?

When you push a signed commit or tag to GitHub, and the signature matches a key you've registered with your account, GitHub shows a green ✅ Verified badge next to it. This proves that the changes truly came from you — and haven’t been tampered with.

In professional or open-source work, this improves trust, authenticity, and security.

 Step-by-Step Setup in GitHub Codespaces

🔹 Step 1: Generate an SSH Key

Open the terminal in your Codespace and run:

ssh-keygen -t ed25519 -C "your_email@example.com"

• Press Enter to accept the default path (~/.ssh/id_ed25519)

• You can skip the passphrase for convenience

🔹 Step 2: Enable SSH Signing in Git

Next, configure Git to use SSH for signing:

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

This ensures all your commits are signed using your new key.

🔹 Step 3: Add Your SSH Public Key to GitHub

Run the following to print your SSH public key:

cat ~/.ssh/id_ed25519.pub

Copy the entire output — it will look like:

ssh-ed25519 AAAAC3Nz... your_email@example.com

Then:

1. Go to https://github.com/settings/ssh/new

2. Set:

   • Title: Codespace Signing Key

   • Key type: Signing Key

   • Key: Paste your copied key

3. Click Add SSH key

🔹 Step 4: Confirm Git Identity (Optional)

Make sure your Git user info matches your GitHub account:

git config --global user.name "Your Name"
git config --global user.email "your_email@example.com"

🔹 Step 5: Make a Signed Commit

Test everything:

echo "# test" >> verify-test.md
git add verify-test.md
git commit -m "test: signed commit"
git push

Now check your commit on GitHub. You should see the green ✅ Verified badge.

---

🏷️ Enable Verified Tags in GitHub Codespaces

GitHub also allows you to verify tags, but they must also be manually signed.

🔹 Step 1: Enable Tag Signing

git config --global tag.gpgSign true

🔹 Step 2: Delete Unsigned Tag (If Already Created)

git tag -d v1.0.0

🔹 Step 3: Create a Signed Tag

git tag -s v1.0.0 -m "v1.0.0 release" --format=ssh

🔹 Step 4: Push the Tag

git push origin v1.0.0

🔹 Step 5: Check Verification on GitHub

Visit your repository’s Tags page and confirm that the tag shows a ✅ Verified badge.

---

 Automate with setup.sh (Every Codespace)

Instead of repeating this process manually every time, you can automate the setup using a script.

setup.sh

#!/bin/bash

# === Setup SSH Commit & Tag Signing in GitHub Codespaces ===
# Author: nayandas69
# Repo: https://github.com/nayandas69/

set -e

echo "🔐 Setting up SSH commit and tag signing..."

KEY_PATH="$HOME/.ssh/id_ed25519"

# Generate key if not found
if [ ! -f "$KEY_PATH" ]; then
  echo "📁 Generating new SSH key..."
  ssh-keygen -t ed25519 -C "your_email@example.com" -f "$KEY_PATH" -N ""
else
  echo "✅ SSH key already exists."
fi

# Git signing setup
git config --global gpg.format ssh
git config --global user.signingkey "$KEY_PATH.pub"
git config --global commit.gpgsign true
git config --global tag.gpgSign true

# Git identity
git config --global user.name "nayandas69"
git config --global user.email "your_email@example.com"

# Show key for GitHub
echo ""
echo "📋 Copy this key and add it to GitHub as a Signing Key:"
cat "$KEY_PATH.pub"
echo ""
echo "👉 https://github.com/settings/ssh/new"

---------------------------------------------------------------------------------------------------------

Automate This in Every Codespace

1. Create a GitHub repo: https://github.com/nayandas69/dotfiles

2. Put setup.sh in it

3. In GitHub → Codespaces settings, link this repo as your dotfiles repo

GitHub will auto-run it on every new Codespace.

With SSH signing set up for both commits and tags in GitHub Codespaces, you’ll never push an unverified change again. It boosts your security, builds trust, and shows you're serious about best practices.

Whether you're working solo or on a team — verified commits and tags are a smart move.

Happy coding!