Context

At the moment, if you use this action and have the Require signed commits setting enabled for a protected branch, the PR generated can't be merged.

Example

Crowdin, a popular localisation management tool, has a similar action which opens a PR using a bot.

They allow you to pass a gpg_private_key as a config option, which will enable signed commits for the bot opening the PR. See options here.