GitHub announced on October 12, 2026 the limited public preview of push attribution for commits. The platform now records, for every pushed commit, the authenticated identity of the person who performed the push, independently of the author and committer fields the Git client declares. A new repository rule condition lets teams require that the committer match a verified address of that authenticated pusher.
The problem: declarative commit metadata
A commit’s author and committer fields are plain text supplied by the pushing client. Anyone with write access can enter any name and email there. A compromised low-privilege account can therefore produce commits that look like they came from a trusted maintainer, sidestep review policies built on declared identity, and weaken the reliability of audit trails during an incident.
What push attribution changes
GitHub already authenticates every push. The new piece is storing that authenticated identity permanently at the commit level rather than only at the push operation level. Every pushed commit now carries a pusher identity distinct from its author and committer metadata, visible everywhere commit history appears in the UI and via the API.
| Field | Source | Can be spoofed |
|---|---|---|
| Author | Declared by the Git client | Yes |
| Committer | Declared by the Git client | Yes |
| Pusher (new) | Authenticated GitHub session | No |
A repository rule for strict enforcement
The preview introduces a new rule condition, Committer must match pusher, which blocks any push where the committer’s address does not match any verified email on the authenticated account that performed the push. This is the mechanism that turns plain traceability into an actual defense against commit identity spoofing: the rule is added to an existing ruleset rather than enabled globally.
The new rule condition blocks any push where the committer’s address does not match any verified email of the authenticated pusher.
The limited preview is restricted to GitHub Enterprise customers. Access must be requested through the account team; the announcement lists no other technical prerequisite.
Scope and limits
The pusher identity is added alongside the existing fields rather than replacing them: a commit still shows a declared author and committer, now joined by a verified identity. For security teams, this makes it possible to spot at a glance a commit whose declared metadata diverges from the identity that actually performed the operation, without waiting on a manual cross-check of access logs. The underlying concern echoes the one already raised by npm’s move to open dist-tag management to trusted publishing: both replace a self-declared claim with an identity the platform itself verifies. On the day-to-day workflow side, the feature changes nothing for teams already juggling several parallel Git worktrees: the pusher identity is captured at push time regardless of which worktree or branch it came from.
{
"commit": "a3f9c21",
"author": { "name": "Alice Martin", "email": "[email protected]" },
"committer": { "name": "Alice Martin", "email": "[email protected]" },
"pusher": { "login": "alice-m", "verified_email": "[email protected]" }
}What to remember
Push attribution addresses a known blind spot in Git: how easily the author and committer fields can be forged by anyone with write access. By keeping an independently verifiable, authenticated pusher identity, and by letting teams enforce it through a repository rule, GitHub gives security teams a reliable signal where they previously had to manually cross-reference access logs with Git history. The feature remains, for now, limited to Enterprise customers in preview.
A feature like this would have spared more than one cold sweat during repository audits where a commit signed with a maintainer’s name turned out to have been pushed by a poorly scoped service token. GPG signing has addressed part of this problem for a long time, but it remains optional and poorly adopted outside large open-source projects; a pusher identity verified by the platform itself, impossible to switch off client-side, changes the equation for teams that never got around to setting up commit signing. Whether GitHub extends the rule beyond the Enterprise tier remains to be seen. — Simon Janvier
Further reading: the official GitHub changelog entry on push attribution.
