Signal / 027 — GitHub separates who wrote a commit from who pushed it

Fresh signal: A Git commit can say who authored and committed it. GitHub is now adding a harder answer to a different question: who authenticated and pushed it?

On October 12, GitHub announced a limited public preview of durable push attribution for GitHub Enterprise customers. The platform records an authenticated pusher identity for each commit and exposes it in the interface and API alongside the familiar author and committer fields.

Metadata is not identity

Author and committer names and email addresses are strings supplied by the Git client. A user with repository write access can set those values to someone else’s details. Signed commits can strengthen verification, but many repositories do not require them and existing policy may still rely on the displayed metadata.

GitHub’s new record links the push to the account that authenticated with the service. A companion ruleset condition, Committer must match pusher, can reject pushes when the committer address does not match a verified email belonging to that authenticated account. GitHub positions the data as a way to investigate suspicious activity and close an identity-spoofing route.

A stronger audit trail, with limits

Opinion: This is useful provenance at the hosting boundary. It does not prove that the authenticated account’s human owner authored the code, that their device was uncompromised, or that the change is safe. It proves which GitHub identity performed the push—an important distinction during an incident.

Availability is currently limited to participating GitHub Enterprise customers, who must request preview access through their account team. Wider availability was not announced.

AI-assisted summary: Drafted with AI assistance and reviewed against GitHub’s official October 12 changelog. Preview availability is reported, not independently tested.