---
title: "Commits"
description: "Choose who the agent's commits are from, credit a co-author, and get commits GitHub shows as verified."
canonical_url: "https://github-tools.com/commits"
---
# Commits

> Choose who the agent's commits are from, credit a co-author, and get commits GitHub shows as verified.

## Overview

Commits made by a GitHub tools agent, when it edits files or merges a pull request, come from the token's owner by default: the user behind a personal token, or the App behind an installation token.

<commit-attribution>



</commit-attribution>

You can credit someone else as co-author, which is the usual way to mark a commit as made with an agent, or set a different author and committer. Which token you use also decides whether GitHub shows the commits as verified.

## Configure

Set the commit options where you create the tools or the agent:

```ts [tools.ts]
import { createGithubTools } from '@github-tools/sdk'

const tools = createGithubTools({
  preset: 'pr-author',
  coAuthors: [
    { name: 'my-bot[bot]', email: '12345+my-bot[bot]@users.noreply.github.com' },
  ],
})
```

<table>
<thead>
  <tr>
    <th>
      Option
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      What it sets
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        author
      </code>
    </td>
    
    <td>
      The token's owner
    </td>
    
    <td>
      Who wrote the change, as <code>
        { name, email }
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        committer
      </code>
    </td>
    
    <td>
      The token's owner
    </td>
    
    <td>
      Who applied it, as <code>
        { name, email }
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        coAuthors
      </code>
    </td>
    
    <td>
      None
    </td>
    
    <td>
      <code>
        Co-authored-by
      </code>
      
       trailers added to every commit message
    </td>
  </tr>
</tbody>
</table>

The model can't change these options: they're fixed for the tool set, not passed per call.

### Which tools commit

<table>
<thead>
  <tr>
    <th>
      Tool
    </th>
    
    <th>
      <code>
        author
      </code>
      
      , <code>
        committer
      </code>
    </th>
    
    <th>
      <code>
        coAuthors
      </code>
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        createOrUpdateFile
      </code>
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        editFiles
      </code>
    </td>
    
    <td>
      Yes
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        mergePullRequest
      </code>
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Yes, in the merge commit message
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        enablePullRequestAutoMerge
      </code>
    </td>
    
    <td>
      No
    </td>
    
    <td>
      Yes, in the commit made when it merges
    </td>
  </tr>
</tbody>
</table>

## Credit a co-author

`coAuthors` keeps the token's owner as the author and credits someone else in the commit message. Every commit message ends with a trailer, which GitHub shows as a second avatar on the commit:

```txt [commit message]
Update README.md

Co-authored-by: my-bot[bot] <12345+my-bot[bot]@users.noreply.github.com>
```

`coAuthors` works whether or not the commit is signed. GitHub's docs cover [commits with several authors](https://docs.github.com/en/pull-requests/committing-changes-to-your-project/creating-and-editing-commits/creating-a-commit-with-multiple-authors).

## Get verified commits

GitHub shows a commit as **Verified** when it's signed. `createOrUpdateFile` and `editFiles` first try GitHub's `createCommitOnBranch` GraphQL mutation, which writes every change as one commit. GitHub signs that commit only when the token acts as a GitHub App:

<table>
<thead>
  <tr>
    <th>
      Token
    </th>
    
    <th>
      Verified
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      GitHub App installation token, including a <a href="https://github-tools.com/auth#vercel-connect">
        Vercel Connect
      </a>
      
       one
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        GITHUB_TOKEN
      </code>
      
       in GitHub Actions
    </td>
    
    <td>
      Yes
    </td>
  </tr>
  
  <tr>
    <td>
      Personal access token
    </td>
    
    <td>
      No
    </td>
  </tr>
  
  <tr>
    <td>
      User OAuth token, including a Connect <a href="https://github-tools.com/auth#per-user-tokens">
        user token
      </a>
    </td>
    
    <td>
      No
    </td>
  </tr>
</tbody>
</table>

Use an App token when the branch's protection rules require signed commits. GitHub's docs cover [signature verification](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification).

## Set the author or committer

`author` and `committer` make the commits come from another identity than the token's owner. Setting either one skips the signed path, because the mutation doesn't accept custom identities. The tools then use the REST contents API: the commit isn't signed, and `editFiles` makes one commit per file.

## FAQ

<accordion>
<accordion-item label="Why isn't a commit made with a user token verified?">

GitHub signs commits only for bots, because it doesn't hold the user's signing key. A commit made with a user token is valid but not verified.

</accordion-item>

<accordion-item label="What if GitHub refuses the signed commit?">

The tools fall back to the REST contents API and log a `Signed commit failed` warning. The commit is then unsigned.

</accordion-item>

<accordion-item label="What if the branch moves while the agent commits?">

If the branch moves between reading it and committing, the mutation fails instead of falling back, so the agent doesn't overwrite a change it hasn't seen.

</accordion-item>

<accordion-item label="Where can I set these options?">

`createGithubTools`, `createGithubAgent`, `createDurableGithubAgent`, TanStack AI and the [eve extension](https://github-tools.com/integrations/eve) all take them. With [single tool factories](https://github-tools.com/tools#pick-single-tools), pass them next to `needsApproval`, for example `editFiles(token, { coAuthors })`.

</accordion-item>
</accordion>


## Sitemap

See the full [sitemap](https://github-tools.com/sitemap.md) for all pages.