GitHub records the authenticated pusher of every commit and adds a rule that blocks pushes whose committer doesn’t match, in limited preview
Commit author fields can be forged by anyone with write access; GitHub now attaches who actually pushed.
// Key points
- Author and committer fields are strings supplied by the client, so anyone with write access can set any name and email.
- Every pushed commit now carries a durable, authenticated pusher identity, shown in the UI and API next to author and committer.
- A new ruleset condition, “Committer must match pusher”, blocks pushes where the committer doesn’t match a verified email of the pusher.
- It is a limited public preview for GitHub Enterprise customers, who request access through their account team.
Builder's takeWith more commits now pushed by coding agents, who actually pushed is what an audit needs. I’d give each agent its own identity and token instead of a borrowed personal one, and turn this rule on for the main repositories once it reaches us.