From aea52a7f78424e792ddc62eb6371755c288395ed Mon Sep 17 00:00:00 2001
From: Dan McNulty <daniel.mcnulty@fingerprint.com>
Date: Wed, 23 Sep 2026 14:53:08 -0500
Subject: [PATCH 1/2] chore: add prep sync changesets with gh API put

- Change the `Commit changeset(s)` step in the `ai-prep-sync-pr` to
  use the gh API to put each changeset individually. This results in
  the commits created by the PR to be signed.
---
 .github/workflows/ai-prep-sync-pr.yml | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ai-prep-sync-pr.yml b/.github/workflows/ai-prep-sync-pr.yml
index f20f8282..79e9a7f4 100644
--- a/.github/workflows/ai-prep-sync-pr.yml
+++ b/.github/workflows/ai-prep-sync-pr.yml
@@ -110,19 +110,21 @@ jobs:
             echo "title=$new_title" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Commit and push changeset(s)
+      - name: Commit changeset(s)
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
-          if [ -z "$(git status --porcelain .changeset)" ]; then
-            echo "No changeset changes to commit"
-            exit 0
-          fi
-          git config user.name "fingerprint-dx-team-actions-runner[bot]"
-          git config user.email "fingerprint-dx-team-actions-runner[bot]@users.noreply.github.com"
-          git add .changeset/
-          git commit -m "chore: add changeset(s) [skip ci-ai-prep]"
-          git push origin HEAD:${{ github.event.pull_request.head.ref }}
+          # Commit through the API so GitHub signs each commit with the app's
+          # key; a local `git commit` + `git push` would be unsigned.
+          for file in $(git ls-files --others --exclude-standard -- .changeset/); do
+            echo "Committing $file"
+            gh api --method PUT "repos/$GITHUB_REPOSITORY/contents/$file" \
+              --field branch="$BRANCH" \
+              --field message="chore: add changeset $(basename "$file") [skip ci-ai-prep]" \
+              --field content="$(base64 -w0 "$file")" \
+              --silent
+          done
 
       - name: Rename PR
         if: steps.title.outputs.title != ''

From 7f7b4383f3bd88a49e76ceea57d044c564316aa9 Mon Sep 17 00:00:00 2001
From: Dan McNulty <daniel.mcnulty@fingerprint.com>
Date: Wed, 23 Sep 2026 15:46:09 -0500
Subject: [PATCH 2/2] chore: log and exit when no changeset updates made

---
 .github/workflows/ai-prep-sync-pr.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ai-prep-sync-pr.yml b/.github/workflows/ai-prep-sync-pr.yml
index 79e9a7f4..2b4e0a5c 100644
--- a/.github/workflows/ai-prep-sync-pr.yml
+++ b/.github/workflows/ai-prep-sync-pr.yml
@@ -115,6 +115,11 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
+          if [ -z "$(git status --porcelain .changeset)" ]; then
+            echo "No changeset changes to commit"
+            exit 0
+          fi
+
           # Commit through the API so GitHub signs each commit with the app's
           # key; a local `git commit` + `git push` would be unsigned.
           for file in $(git ls-files --others --exclude-standard -- .changeset/); do