This isn't completely correct yet. Looking at how Dependabot does it, commits are created with the author dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> and the committer GitHub <noreply@github.com>

This is how pull requests and commits made through the file uploader/editor on GitHub.com are created as well. The author being the noreply email from the current user and the committer being GitHub <noreply@github.com>.

That email Dependabot uses is an actual account: https://api.github.com/users/dependabot-preview%5Bbot%5D

It turns out that GitHub Actions has an account tied to it as well: https://api.github.com/users/github-actions%5Bbot%5D (You'll have seen this account show up if you use ${{ secrets.GITHUB_TOKEN }} to create a pull request for example.)

So ideally, a commit made by a workflow should be created with github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> as the author and GitHub <noreply@github.com> as the committer.

What that 41898282 stand for?

@tenhobi It's the user id of the Github Actions account/bot.

EDIT: I should probably also explain that any commit created on GitHub.com (or by a GitHub owned bot like Dependabot) always use the email id+login@users.noreply.github.com as the author.

You can find your unique email under "Keep my email addresses private" in https://github.com/settings/emails

Mine is 6368561+kevinvanrijn@users.noreply.github.com for example. (This is all public information through the API.)

@kevinvanrijn Yes, it would be nice if you added a short note on that. Then, this is good to go!

@koppor Done.

A quick bit of news from another action. create-pull-request is also using the GitHub Actions bot user as its default account since v2.