Support GHES with skip-commit-verification (#364)

README.md

@@ -54,6 +54,10 @@ An example of a non-semantic version is a commit hash when using git submodules.
 
 _Optional_ A pull request number, only required if triggered from a workflow_dispatch event. Typically this would be triggered by a script running in a seperate CI provider. See [Trigger action from workflow_dispatch event](#trigger-action-from-workflow_dispatch-event)
 
+### `skip-commit-verification`
+
+_Optional_ If true, then the [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) action will not expect the commits to have a verification signature. It is required to set this to true in GitHub Enterprise Server.
+
 ## Usage
 
 Configure this action in your workflows providing the inputs described above.

action.yml

@@ -32,6 +32,10 @@ inputs:
   pr-number:
     description: 'A pull request number, only required if triggered from a workflow_dispatch event'
     required: false
+  skip-commit-verification:
+    description: 'If true, then the action will not expect the commits to have a verification signature. It is required to set this to true in GitHub Enterprise Server'
+    required: false
+    default: false
 
 runs:
   using: 'composite'
@@ -40,6 +44,8 @@ runs:
       id: dependabot-metadata
       uses: dependabot/fetch-metadata@v1
       if: ${{ github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' }}
+      with:
+        skip-commit-verification: ${{ inputs.skip-commit-verification }}
     - name: Merge/approve PR
       uses: actions/github-script@v6
       if: ${{ github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' }}