# ci: Verify commits and releases created with Zed Zippy \(\#54264\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/98f94e20643c4012a05510d78f3fdf820e15df7e)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 98f94e20643c4012a05510d78f3fdf820e15df7e

Requested commit: 98f94e20643c4012a05510d78f3fdf820e15df7e

Commit: 98f94e20643c4012a05510d78f3fdf820e15df7e

Tree: dfd8e21d1b7f9858b7fd0a6f2775a70ee6a08cb6

Author: Finn Evers

Committer: GitHub

## Message

```
ci: Verify commits and releases created with Zed Zippy (#54264)

This changes our approach for creating Zed version bumps with the Zed
Zippy identity:

With these changes, the Zippy version bumps as well as the tag creations
will be verified as per
https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#signature-verification-for-bots.
This adds an extra layer of security for version bumps and release
triggers done by the Zippy identity.

Eventually, we can move code more around for this so it happens in the
bot itself, but for now, I think its a good and solid interim solution
to have this here.

Release Notes:

- N/A
```

## Parents

- [9ba6a32ec6c4a231627db1d21c7cd72416b97b4a](https://git.cafe/gitcafe/zed/commit/9ba6a32ec6c4a231627db1d21c7cd72416b97b4a?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/98f94e20643c4012a05510d78f3fdf820e15df7e?format=markdown)