git-empty-commit-signature.ts

import * as openpgp from 'openpgp';
import {Octokit} from "@octokit/rest";

const privateKeyArmored: string = `-----BEGIN PGP PRIVATE KEY BLOCK-----
HAHAHAHA did you really think
-----END PGP PRIVATE KEY BLOCK-----
`;

async function createEmptyCommit(
    octokit: Octokit,
    owner: string,
    repo: string,
    tree: string,
    refCommit: string,
    authorName: string,
    authorEmail: string,
    committerName: string,
    committerEmail: string,
    commitMessage: string,
) {
    const now = Date.now();
    const nowStr = new Date(now).toISOString();

    // you may have to wrap this in a openpgp.decryptKey if you have a passphrase
    const key = await openpgp.readPrivateKey({
        armoredKey: privateKeyArmored,
    });

    // ref: https://github.com/git/git/blob/v2.42.0/commit.c#L1602-L1667
    //      also, git cat-file -p HEAD
    const message = await openpgp.createMessage({
        text: [
            'tree ' + tree,
            'parent ' + refCommit,
            'author ' + authorName + ' <' + authorEmail + '> ' + Math.floor(now / 1000) + ' +0000',
            'committer ' + committerName + ' <' + committerEmail + '> ' + Math.floor(now / 1000) + ' +0000',
            '',
            commitMessage,
        ].join('\n')
    });
    const detachedSignature = await openpgp.sign({
        message: message,
        signingKeys: [key],
        detached: true,
    });

    const {data} = await octokit.git.createCommit({
        owner: owner,
        repo: repo,
        message: commitMessage,
        tree: tree,
        parents: [refCommit],
        author: {
            name: authorName,
            email: authorEmail,
            date: nowStr,
        },
        committer: {
            name: committerName,
            email: committerEmail,
            date: nowStr,
        },
        signature: detachedSignature.toString(),
    });

    return data;
}