GitHub now records who really pushed each commit, not just the author
Author and committer are forgeable strings. GitHub now logs the authenticated pusher and can block mismatched commits — Enterprise preview for now.
Copy markdown
Your commit author field was never identity
GitHub now permanently records the authenticated account that pushed each commit, surfaced in the UI and API next to the existing author and committer fields. Those two are just client-supplied strings — anyone with write access can set them to impersonate a maintainer, so the pusher is the first value GitHub actually verifies.
A ruleset to block spoofed committers
A new repository rule condition, “Committer must match pusher,” rejects any push whose committer email isn’t a verified address of the authenticated pusher. Drop it into a push ruleset and forged-committer commits stop at the door — note it checks the committer field, not the author.
The catch: Enterprise-only, by request
It’s a limited public preview for GitHub Enterprise, and you have to ask your account team to switch it on — off by default, with nothing said yet for Team or Free. Still worth clocking the direction, a week after the Zod repo backdoor put commit trust back under the microscope.