GitHub Adds Durable Pusher Attribution for Commits in Limited Public Preview

What changed?

GitHub now records the authenticated user who actually pushes each commit and makes that identity visible in the repository UI and API alongside the traditional author and committer fields. This "pusher identity" is stored durably and is independent of any information the client includes in the commit itself. Additionally, administrators can enforce a new repository rule, 'Committer must match pusher', to block pushes where the committer metadata doesn't match a verified email for the user who performed the push. These changes are available as a limited public preview for GitHub Enterprise customers.

Why does it matter to an everyday developer?

Previously, commit author and committer fields could be arbitrarily set by anyone pushing to the repository, allowing for commit identity spoofing and making security review and audit trails less reliable. With this change, it is always clear who pushed each commit based on authenticated identity, not just commit metadata. This helps teams detect suspicious pushes, investigate incidents more efficiently, and enforce stronger repository integrity. The additional repository rule further reduces opportunities for forgery by requiring the committer metadata to match the identity of the authenticated pusher.

What can the developer do now?

GitHub Enterprise administrators can request access to the limited public preview from their account team. Once enabled, repository maintainers can review committer and pusher information directly in the GitHub UI and API, and optionally enable the 'Committer must match pusher' repository rule to enhance security. Developers should be aware that their authenticated identity will now be durably attributed to every commit they push, regardless of the committer metadata they supply.