GitHub 在有限公开预览中推出提交推送归属功能

GitHub 现在会持久记录推送每次提交的已认证用户，并在 UI 和 API 中将该推送者身份与现有的作者和提交者字段一同展示。

提交作者和提交者字段只是由推送客户端提供的字符串，因此，任何拥有仓库写入权限的人都可以将其设置为任意姓名和电子邮件地址。这意味着，若攻击者入侵了一个低权限账户，便可能伪造看似来自受信任维护者的提交，规避审查策略并扰乱审计记录。GitHub 已经会对推送操作进行身份验证。本次发布将在作者和提交者元数据之外，新增持久的、逐提交记录的推送者归属信息。

通过本次发布：

• 现在，推送到仓库的每次提交都会附带持久的、经过认证的推送者身份，该身份独立于作者和提交者元数据中的任何声明。
• 新增仓库规则条件 Committer must match pusher：当提交者元数据与已认证推送者的任一已验证电子邮件地址不匹配时，将阻止该推送。这堵住了一条可用于伪造提交身份的路径。

您可以使用推送者身份抽查可疑活动，或加快安全调查，而不必依赖未经验证的元数据。之所以能够这样做，是因为现在在所有展示提交的位置都可以看到推送者身份。若要对仓库执行更严格的身份要求，请在规则集中添加新的 Committer must match pusher 规则。

推送归属功能现已面向 GitHub Enterprise 客户以有限公开预览形式提供。如果您有兴趣加入预览，请联系您的客户团队并申请访问权限。

了解更多关于配置推送规则集的信息。

GitHub now durably records the authenticated user who pushed each commit and surfaces that pusher identity in the UI and API alongside the existing author and committer fields.

Commit author and committer fields are just strings that the pushing client supplies, so anyone with write access to a repository can set them to any name and email they choose. That makes it possible for an attacker who compromises a low-privilege account to forge commits that appear to come from a trusted maintainer, evading review policies and confusing audit trails. GitHub already authenticates pushes. This release adds durable, per-commit pusher attribution alongside the author and committer metadata.

With this release:

• Every commit pushed to a repository now has a durable, authenticated pusher identity attached to it, independent of whatever the author and committer metadata claims.
• A new repository rule condition, Committer must match pusher, blocks pushes where the committer metadata doesn’t match any verified email address of the authenticated pusher. This closes a path for commit identity spoofing.

You can use the pusher identity to spot-check suspicious activity or speed up security investigations instead of relying on unverified metadata. You can do this because the pusher identity is now visible wherever commits are shown instead. To enforce stricter identity requirements on a repository, add the new Committer must match pusher rule to a ruleset.

Push attribution is available now as a limited public preview for GitHub Enterprise customers. If you are interested in joining the preview, please contact your account team and request access.

Learn more about configuring push rulesets.