Push attribution for commits in limited public preview
GitHub now records the authenticated identity of the user who pushed a commit to a repository. This pusher identity is now exposed alongside existing author and committer metadata in both the web UI and the API.
Verified State Diff
Impact & Verification Analysis
Developers, security teams, and enterprise administrators managing repository access and audit logs.
It closes a significant security visibility gap by distinguishing between the person who authored a commit and the person who actually pushed it to the remote repository, which is critical for compliance and incident response.
Full Fact Overview
Historically, Git metadata only tracked the 'Author' (who wrote the code) and the 'Committer' (who created the commit object). These fields are part of the Git commit object itself and can be easily spoofed or modified. By introducing 'Pusher' attribution, GitHub is leveraging its internal authentication layer to record the identity of the user who actually performed the 'git push' operation. This data is stored server-side by GitHub, providing an immutable audit trail that is independent of the commit's internal metadata, significantly improving security auditing and accountability in collaborative environments.