GitHub adds durable push attribution to commits in limited preview

What happened

GitHub has introduced push attribution, a new feature that durably records the authenticated user who pushed each commit to a repository. This identity is now displayed in the GitHub UI and API alongside the existing author and committer fields. The feature is entering limited public preview for GitHub Enterprise customers.

The problem push attribution solves

Commit author and committer fields are just strings supplied by the pushing client, meaning anyone with write access to a repository can set them to any name and email. This creates a security vulnerability: an attacker who compromises a low-privilege account can forge commits that appear to come from a trusted maintainer, bypassing review policies and obfuscating audit trails. While GitHub already authenticates all pushes at the protocol level, this authenticated identity has not previously been durably recorded or surfaced to users. Push attribution closes this gap by attaching the authenticated pusher identity to every commit, independent of whatever the author and committer metadata claims.

What changed

With this release, every commit pushed to a repository now carries a durable, authenticated pusher identity. Additionally, GitHub introduces a new repository rule condition called 'Committer must match pusher'. When enabled, this rule blocks pushes where the committer metadata doesn't match any verified email address of the authenticated pusher. This rule prevents a specific path for commit identity spoofing by ensuring that the committer field aligns with the actual identity of the person performing the push.

The pusher identity is now visible wherever commits are shown in GitHub, both in the UI and via the API. This visibility enables developers and security teams to use the pusher identity for spot-checking suspicious activity or accelerating security investigations, rather than relying solely on unverified metadata.

How to enforce stricter identity requirements

To enforce stricter identity requirements on a repository, administrators can add the new 'Committer must match pusher' rule to a ruleset. This provides a declarative way to prevent commits with spoofed author or committer information from being merged, strengthening the integrity of the commit history and making it harder for attackers to hide their tracks within the repository.

Getting started with the preview

Push attribution is currently available only as a limited public preview for GitHub Enterprise customers. Organizations interested in joining the preview should contact their GitHub account team to request access. Once enrolled, teams can configure push rulesets to take advantage of the new 'Committer must match pusher' condition and use the pusher identity information for audit and compliance purposes.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.