Push attribution for commits in limited public preview

GitHub now durably records the authenticated user who pushed each commit and surfaces that pusher identity in the UI and API alongside the existing author and committer fields.

Commit author and committer fields are just strings that the pushing client supplies, so anyone with write access to a repository can set them to any name and email they choose. That makes it possible for an attacker who compromises a low-privilege account to forge commits that appear to come from a trusted maintainer, evading review policies and confusing audit trails. GitHub already authenticates pushes. This release adds durable, per-commit pusher attribution alongside the author and committer metadata.

With this release:

• Every commit pushed to a repository now has a durable, authenticated pusher identity attached to it, independent of whatever the author and committer metadata claims.
• A new repository rule condition, Committer must match pusher, blocks pushes where the committer metadata doesn’t match any verified email address of the authenticated pusher. This closes a path for commit identity spoofing.

You can use the pusher identity to spot-check suspicious activity or speed up security investigations instead of relying on unverified metadata. You can do this because the pusher identity is now visible wherever commits are shown instead. To enforce stricter identity requirements on a repository, add the new Committer must match pusher rule to a ruleset.

Push attribution is available now as a limited public preview for GitHub Enterprise customers. If you are interested in joining the preview, please contact your account team and request access.

Learn more about configuring push rulesets.

The post Push attribution for commits in limited public preview appeared first on The GitHub Blog.