How to fix remote: error: GH006: Protected branch update failed - commits must be signed in Git

First, verify whether you have any GPG keys available for signing:

gpg --list-secret-keys --keyid-format=long

If you see output with sec entries, you have keys available. Note the key ID after the algorithm (e.g., rsa4096/3AA5C34371567BD2 - the part after the slash is your key ID).

If no keys are listed, you'll need to generate one or use SSH signing instead.

If you don't have a GPG key, create one:

gpg --full-generate-key

Select the following options:
- Key type: RSA and RSA (default)
- Key size: 4096 bits (recommended)
- Expiration: Choose based on your security policy (1-2 years is common)
- Enter your name and the email address associated with your GitHub account

After generation, get your key ID:

gpg --list-secret-keys --keyid-format=long

Export your public key:

gpg --armor --export YOUR_KEY_ID

Copy the entire output including -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY BLOCK-----.

Then add it to GitHub:
1. Go to GitHub.com → Settings → SSH and GPG keys
2. Click "New GPG key"
3. Paste your public key and save

Alternatively, use the GitHub CLI:

gpg --armor --export YOUR_KEY_ID | gh gpg-key add -

Tell Git which key to use for signing:

git config --global user.signingkey YOUR_KEY_ID

Enable automatic commit signing:

git config --global commit.gpgsign true

If you're on macOS and using GPG Suite, you may need to set the GPG program:

git config --global gpg.program gpg

On some systems, you might need to specify the full path:

git config --global gpg.program $(which gpg)

If you have unsigned commits that need to be pushed, you must re-sign them. For the most recent commit:

git commit --amend --no-edit -S

For multiple commits, use interactive rebase:

# Re-sign the last N commits
git rebase --exec 'git commit --amend --no-edit -S' HEAD~N

Replace N with the number of commits to re-sign. For example, to re-sign the last 3 commits:

git rebase --exec 'git commit --amend --no-edit -S' HEAD~3

Note: This rewrites commit history. If you've already shared these commits, you'll need to force push.

After re-signing, push your changes:

git push

If you rebased and rewrote history, you may need to force push:

git push --force-with-lease

The --force-with-lease flag is safer than --force as it prevents overwriting others' work.

If you prefer SSH keys over GPG, Git 2.34+ supports SSH signing:

# Configure SSH signing
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

Add your SSH key to GitHub as a signing key:
1. Go to GitHub.com → Settings → SSH and GPG keys
2. Click "New SSH key"
3. Select "Signing Key" as the key type
4. Paste your public key

SSH signing is simpler to set up if you already use SSH for authentication.

Confirm that your commits are properly signed:

git log --show-signature -1

You should see "Good signature" in the output. You can also check on GitHub - signed commits show a "Verified" badge next to them.

To verify all commits in a range:

git log --show-signature HEAD~5..HEAD