GitHub Opens Push Attribution to Enterprise Customers in Limited Public Preview, Adding a Pusher Identity and a "Committer must match pusher" Rule
GitHub's October 12 changelog says it now records the authenticated pusher of each commit and adds a ruleset condition that blocks mismatched committers, in a limited public preview for Enterprise.
Overview
GitHub published a changelog entry on October 12, 2026 titled “Push attribution for commits in limited public preview.” According to the GitHub changelog, GitHub “now durably records the authenticated user who pushed each commit and surfaces that pusher identity in the UI and API alongside the existing author and committer fields.” The entry also introduces a new repository rule condition named “Committer must match pusher.” The entry is labeled “application security” and “platform governance.”
What We Know
The problem GitHub describes
The GitHub changelog states that “Commit author and committer fields are just strings that the pushing client supplies, so anyone with write access to a repository can set them to any name and email they choose.” GitHub says this makes it possible for an attacker who compromises a low-privilege account to forge commits that appear to come from a trusted maintainer, “evading review policies and confusing audit trails.” The same entry notes that “GitHub already authenticates pushes,” and describes the release as adding durable, per-commit pusher attribution next to the author and committer metadata.
What the release changes
Per the GitHub changelog, the release has two parts:
- Pusher identity on commits. The entry says every commit pushed to a repository now has a durable, authenticated pusher identity attached, independent of what the author and committer metadata claims. It says this identity is visible wherever commits are shown, and GitHub suggests using it to spot-check suspicious activity or speed up security investigations.
- A new ruleset condition. The condition, written in the entry as “Committer must match pusher,” blocks pushes where the committer metadata does not match any verified email address of the authenticated pusher. GitHub says this closes a path for commit identity spoofing, and that a repository owner who wants stricter identity requirements can add the rule to a ruleset. The entry links to GitHub’s documentation on configuring push rulesets.
Availability
The changelog says push attribution “is available now as a limited public preview for GitHub Enterprise customers.” Customers who want to join are told to contact their account team and request access.
Background on push rulesets
GitHub’s rulesets documentation says push rulesets can “block pushes to a private or internal repository and that repository’s entire fork network,” and that for push rulesets, bypass permissions apply to a repository and its entire fork network. The same page describes the existing “Require signed commits” rule: when enabled on a branch, “contributors and bots can only push commits that have been signed and verified to the branch.” That rule checks cryptographic signatures, while the new condition described in the changelog compares committer metadata with the verified emails of the authenticated pusher. The changelog does not say whether the two are meant to be used together.
What We Don’t Know
The changelog entry leaves several points unstated:
- It gives no general availability date and no pricing information.
- It does not say whether the new rule condition can be applied only in push rulesets or also in branch and tag rulesets. It says to add the rule “to a ruleset” and links to push ruleset documentation.
- It does not say whether commits pushed before the preview carry a pusher identity. The entry says commits pushed to a repository “now” have one.
- It does not describe how pushes made by GitHub Apps, bots or automation are attributed, or how the condition treats them.
- It does not name the API fields that expose the pusher identity.
- It does not say whether the feature will reach GitHub Enterprise Server. It refers only to “GitHub Enterprise customers.”
On October 13, 2026, the available-rules page in GitHub’s rulesets documentation did not contain the term “pusher” in the version The Machine Herald read, so the changelog entry is the only source used here for how the feature behaves. Claims about how the rule works are GitHub’s own, and this article does not rest on independent testing.
Analysis
The change addresses a property of Git that the changelog itself describes: author and committer fields are client-supplied text. A pusher identity is tied to the authenticated push rather than to those strings. Whether the “Committer must match pusher” condition proves practical will depend on details the preview entry omits, such as the handling of automation accounts, and on how organizations that rely on shared service identities configure it. Those questions remain open until GitHub publishes fuller documentation.