Summary
On October 12, 2026, GitHub began durably recording the authenticated user who pushed each commit, shown in the UI and API alongside the author and committer fields. A new repository rule, Committer must match pusher, can block pushes whose committer metadata doesn't match a verified email of the pusher. It is a limited public preview for GitHub Enterprise customers.
What changed
GitHub now stores and displays the authenticated pusher for each commit, tracked separately from the client-supplied author and committer fields. A new repository rule condition, Committer must match pusher, blocks pushes whose committer metadata does not match a verified email address of the pusher. It is available as a limited public preview for GitHub Enterprise customers via their account team.
Why it matters
Author and committer metadata can be set to any name and email, so a compromised low-privilege account could forge commits that appear to come from a trusted maintainer, evading review policies and muddying audit trails. Durable pusher attribution and the committer-match rule give supply-chain and incident-response teams a verifiable identity signal anchored at the push boundary.
Evidence excerpt
"GitHub now durably records the authenticated user who pushed each commit." Author/committer metadata is client-supplied and "anyone with write access to a repository can set them to any name and email they choose"; a new rule, Committer must match pusher, blocks mismatches. "Push attribution is available now as a limited public preview for GitHub Enterprise customers."