GitHub adds authenticated pusher identities and a committer-match rule

GitHub's October 12, 2026 update adds a durable, authenticated pusher identity to each commit, independent of the author and committer fields that can be forged by clients with write access. The new "Committer must match pusher" rule condition blocks pushes where the committer metadata does not match any verified email address of the authenticated pusher, closing a vector for commit identity spoofing. This allows better audit trails and faster security investigations by relying on authenticated pusher identity rather than unverified commit metadata. The feature is available as a limited public preview for GitHub Enterprise customers who can request access through their account teams.

This feature reduces the risk of attackers using compromised low-privilege accounts to forge commit author or committer metadata to impersonate trusted maintainers. It enhances the integrity of commit attribution and improves the ability to detect and block suspicious pushes. However, the feature is currently limited to GitHub Enterprise customers in preview and is not enabled by default, so its protective benefits depend on adoption and configuration.

GitHub provides this feature as a limited public preview for Enterprise customers who can request access. To mitigate commit identity spoofing, enable the "Committer must match pusher" rule in repository rulesets once available. This will block pushes where the committer metadata does not match the authenticated pusher's verified email. No other immediate action is required. Monitor GitHub's official documentation and advisories for updates on general availability and default enablement.