Push attribution for commits in limited public preview
By Steven Van ·
GitHub Enterprise customers can request access, with a new rule that checks committer metadata against the pusher's verified emails.
Commits now carry a durable record of the authenticated user who pushed them in GitHub's limited public preview. That identity appears in the UI and API alongside the author and committer fields, which the pushing client supplies and can set to any name and email.
Check who pushed a commit
The pusher identity is independent of the author and committer metadata and is visible wherever commits are shown. It gives reviewers and investigators an authenticated identity to check when suspicious commits appear to come from a trusted maintainer.
Require the committer to match the pusher
A new repository rule, Committer must match pusher, blocks pushes when the committer metadata does not match any verified email address of the authenticated pusher. Repository administrators can add the rule to a ruleset to enforce the check. GitHub's push rulesets documentation covers configuration.
Preview access
Push attribution is available now in limited public preview for GitHub Enterprise customers. Customers interested in joining must contact their account team to request access.
