Who Pushed That GitHub Commit? Check Repository Activity
A commit in your repository shows the name of someone who has never had access to it. Where does GitHub record the account that actually uploaded it?
- Author and committer metadata can differ from the account that authenticated a push.
- Repository Activity connects changes to authenticated users and helps locate the relevant push.
- Per-commit push attribution and a committer-matching rule are in a limited Enterprise preview.
A familiar author name does not identify the sender
The account displayed beside a commit is not necessarily the account that uploaded it. GitHub associates commit-header email addresses with account emails. Its troubleshooting documentation explicitly distinguishes that association from repository access: linking a commit to another user does not grant that user access.
The Git book explains author and committer with an ordinary collaboration example: one person writes a patch, another applies it. Those identities serve different purposes even when nothing suspicious has happened.
| Identity | Question it answers |
|---|---|
| Author | Who is credited with the original work? |
| Committer | Who is recorded as applying the change? |
| Pusher | Which account authenticated the upload? |
For a mislabelled contribution, check your Git email and the emails attached to your account. For an unexplained upload, investigate the server-side activity as well.
Inspect the commit, then find the corresponding activity
GitHub documents this command for inspecting commit details. Replace COMMIT_SHA with the relevant hash:
git show COMMIT_SHA --pretty=fullerThe output separates Author from Commit. The latter is committer metadata, not an authenticated push record.
Open Activity beside the repository’s file list. Narrow the view by branch and time, then filter for direct pushes, merges or force pushes. Use the user filter and Compare changes to connect an event with the code it introduced.
Activity requires repository read access. For changes spanning repositories, permissions or credentials, an authorized administrator can correlate audit logs. GitHub describes Activity as a starting point for investigation, rather than a substitute for complete audit exports.
The preview adds per-commit records and an optional rule
The October 12 announcement adds durable pusher attribution to commit views and APIs. As of October 26, access is a limited public preview for Enterprise customers, requested through their account team.
The Committer must match pusher ruleset condition rejects a push when committer metadata matches none of the sender’s verified email addresses. It compares the committer, not the author. That distinction matters when a maintainer applies somebody else’s work.
Start with the commit hash and the relevant Activity entry. Changing the displayed author addresses attribution; identifying the authenticated upload answers who sent the code.