Merge commit done by '@dependabot merge' command has no signature

[kacperbiegajski]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

gradle

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
registries:
  repository:
    type: maven-repository
    url: https://repository-url
    username: ${{ secrets.USERNAME }}
    password: ${{ secrets.PASSWORD }}

updates:
  - package-ecosystem: "gradle"
    directory: "/"
    registries:
      - repository
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Updated dependency

No response

What you expected to see, versus what you actually saw

I expected that merge commit done by @dependabot merge command would be verified (with signature).

Actually it has no signature, which is strange, because dependabot commits with versions upgrade have.

Upgrade commit:

Merge commit (not verified):

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response