GitHub can now verify who actually pushed a commit

GitHub has started a limited public preview of push attribution for commits. It records the authenticated user who pushed each commit as a separate, tamper-proof field alongside the existing author and committer metadata, and surfaces that pusher identity in the UI and API wherever commits are shown.

The gap this closes: author and committer fields are set by the pushing client, so anyone with write access can put any name and email in them. GitHub’s own advisory says this lets an attacker who compromises a low-privilege account “forge commits appearing to come from trusted maintainers”, which can slip past review policies and corrupt an audit trail. The preview adds a new repository rule condition, Committer must match pusher, that blocks a push if the committer metadata doesn’t match one of the pusher’s own verified email addresses.

Why it matters: right now, a stolen push credential can produce a commit that looks, in the log, exactly like it came from someone else entirely. This gives security teams a verified field to check instead of metadata anyone could have typed in, and the new ruleset condition turns that check into an enforced policy rather than something you spot after the fact.

The caveat: it’s limited to GitHub Enterprise for now, and access has to be requested through your account team rather than switched on directly.