{"version":"1.0","generated_at":"2026-10-13T10:58:52.719226","id":3385,"slug":"push-attribution-for-commits-in-limited-public-preview","title":"GitHub 提交推送归因功能进入有限公测","summary":"GitHub 开始为每次推送持久记录经认证的推送者身份，并在 UI 和 API 中与作者、提交者字段并列展示；同时新增“Committer must match pusher”仓库规则，用于拦截提交者元数据与推送者已验证邮箱不匹配的推送，从而封堵提交身份伪造路径。该能力目前以有限公开预览形式面向 GitHub Enterprise 客户开放。","abstract":"GitHub 提交推送归因功能进入有限公测 GitHub 开始为每次推送持久记录经认证的推送者身份，并在 UI 和 API 中与作者、提交者字段并列展示；同时新增“Committer must match pusher”仓库规则，用于拦截提交者元数据与推送者已验证邮箱不匹配的推送，从而封堵提交身份伪造路径。该能力目前以有限公开预览形式面向 GitHub Enterprise 客户开放。 GitHub 开始为每次推送持久记录经认证的推送者身份，并在 UI 和 API 中与作者、提交者字段并列展示；同时新增“Committer must match pusher”仓库规则，用于拦截提交者元数据与推送者已验证邮箱不匹配的推送，从而封堵提交身份伪造路径。该能力目前以有限公开预览形式面向 GitHub Enterprise 客户开放。 原贴提到：GitHub now durably records the authenticated user who pushed each commit 来源：github.blog GitHub 现在会持久记录推送每次提交的经认证用户，并在 UI 和 API 中把该推送者身份与现有的作者和提交者字段一起展示。 提交的作者和提交者字段只是推送客户端提供的字符串，因此任何拥有仓库写权限的人都可以把它们设置成自己选择的任何姓名和邮箱。这使得攻击者在攻陷一个低权限账号后，可以伪造出看起来来自可信维护者的提交，从而绕过审查策略并扰乱审计线索。 GitHub 本来就会对推送进行认证。本次发布在作者和提交者元数据之外，增加了持久的、按提交记录的推送者归因。现在推送…","access_level":"public","access_label":"公开","access_mode":"full","is_preview":false,"canonical_url":"https://opc.beizhux.com/content/3385/push-attribution-for-commits-in-limited-public-preview","html_url":"https://opc.beizhux.com/content/3385/push-attribution-for-commits-in-limited-public-preview","json_url":"https://opc.beizhux.com/content/3385/push-attribution-for-commits-in-limited-public-preview.json","published_at":"2026-10-13T00:30:11","updated_at":"2026-10-13T10:16:37","category":{"slug":"hotspots","name":"全球热点解读"},"source":{"site":"github.blog","author":"Allison","url":"https://github.blog/changelog/2026-10-12-push-attribution-public-preview"},"tags":["DevSecOps","GitHub","仓库规则","代码审计","供应链安全","提交审计","提交推送归因","规则集","身份伪造","身份验证"],"topics":[{"slug":"ai-daily","name":"AI日报","url":"https://opc.beizhux.com/topics/ai-daily","reason":"这篇内容命中「热点解读」等主题信号。"},{"slug":"ai-tools","name":"AI工具","url":"https://opc.beizhux.com/topics/ai-tools","reason":"这篇内容来自该专题长期覆盖的栏目。"},{"slug":"agent-workflow","name":"Agent工作流","url":"https://opc.beizhux.com/topics/agent-workflow","reason":"这篇内容来自该专题长期覆盖的栏目。"}],"keywords":["全球热点解读","AI日报","AI工具","Agent工作流","每日AI日报","AI信号","热点解读","BuilderPulse","工具","自动化","模型","Cursor"],"questions":[{"question":"GitHub 提交推送归因功能进入有限公测主要讲什么？","answer":"GitHub 开始为每次推送持久记录经认证的推送者身份，并在 UI 和 API 中与作者、提交者字段并列展示；同时新增“Committer must match pusher”仓库规则，用于拦截提交者元数据与推送者已验证邮箱不匹配的推送，从而封堵提交身份伪造路径。该能力目前以有限公开预览形式面向 GitHub Enterprise 客户开放。"},{"question":"这篇文章最值得关注的要点是什么？","answer":"GitHub 开始为每次推送持久记录经认证的推送者身份，并在 UI 和 API 中与作者、提交者字段并列展示；同时新增“Committer must match pusher”仓库规则，用于拦截提交者元数据与推送者已验证邮箱不匹配的推送…；原贴提到：GitHub now durably records the authenticated user who pushed each commit；来源：github.blog"},{"question":"这篇文章和哪些AI专题相关？","answer":"它适合放在AI日报、AI工具、Agent工作流专题里阅读。 关联原因：这篇内容命中「热点解读」等主题信号。；这篇内容来自该专题长期覆盖的栏目。；这篇内容来自该专题长期覆盖的栏目。"},{"question":"阅读这篇文章建议先理解哪些关键词？","answer":"建议先理解AI日报、每日AI日报、AI信号、热点解读、BuilderPulse这些关键词，再结合正文判断工具、机会或风险是否值得进入自己的工作流。"}],"terms":[{"slug":"ai-daily-term","name":"AI日报","definition":"在AI觉醒星球里，「AI日报」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/ai-daily-term","path":"/glossary/ai-daily-term","json_url":"https://opc.beizhux.com/glossary/ai-daily-term.json"},{"slug":"daily-ai-briefing","name":"每日AI日报","definition":"在AI觉醒星球里，「每日AI日报」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/daily-ai-briefing","path":"/glossary/daily-ai-briefing","json_url":"https://opc.beizhux.com/glossary/daily-ai-briefing.json"},{"slug":"ai-signal","name":"AI信号","definition":"在AI觉醒星球里，「AI信号」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/ai-signal","path":"/glossary/ai-signal","json_url":"https://opc.beizhux.com/glossary/ai-signal.json"},{"slug":"ai-news-analysis","name":"热点解读","definition":"在AI觉醒星球里，「热点解读」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/ai-news-analysis","path":"/glossary/ai-news-analysis","json_url":"https://opc.beizhux.com/glossary/ai-news-analysis.json"},{"slug":"builderpulse","name":"BuilderPulse","definition":"在AI觉醒星球里，「BuilderPulse」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/builderpulse","path":"/glossary/builderpulse","json_url":"https://opc.beizhux.com/glossary/builderpulse.json"},{"slug":"ai-tools-term","name":"AI工具","definition":"在AI觉醒星球里，「AI工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-tools-term","path":"/glossary/ai-tools-term","json_url":"https://opc.beizhux.com/glossary/ai-tools-term.json"},{"slug":"tools","name":"工具","definition":"在AI觉醒星球里，「工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/tools","path":"/glossary/tools","json_url":"https://opc.beizhux.com/glossary/tools.json"},{"slug":"automation","name":"自动化","definition":"在AI觉醒星球里，「自动化」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/automation","path":"/glossary/automation","json_url":"https://opc.beizhux.com/glossary/automation.json"}],"preview_hidden_sections":[],"related_items":[{"id":3390,"title":"【必读】每日AI日报 2026-10-13","url":"https://opc.beizhux.com/content/3390/aihot-daily-2026-10-13","summary":"AIHOT 每日 AI 日报：模型发布/更新： - Meta 发布 Muse Wonder 和 Muse Wonder Full，Artificial Analysis 实测智能水平较前代显著提升：Meta 发布 Muse Wonder 和 Muse Wonder Full 两款模型，在 Artificial Ana…","access_level":"public"},{"id":3378,"title":"用户报告 Codex CLI 0.157.0 默认启动持久化自更新后台守护进程","url":"https://opc.beizhux.com/content/3378/codex-cli-0-157-0","summary":"有用户报告，Codex CLI 0.157.0 在打开交互式会话时会默认启动持久后台守护进程 codex app-server --managed-daemon，窗口关闭后仍驻留。该变化主要影响 Linux/WSL2 用户对进程生命周期、资源占用和后台行为的预期。","access_level":"public"},{"id":3381,"title":"Meta Muse Wonder 系列上线 Agent Arena，分数即将公布","url":"https://opc.beizhux.com/content/3381/meta-muse-wonder-agent-arena","summary":"Arena 宣布 Meta 的 Muse Wonder 系列模型上线 Agent Arena，用户可实测，分数即将公布。该信号来自 AIHOT 精选，归类为 ai-models，热度 74。","access_level":"public"}],"usage_policy":{"summarizable":true,"preferred_url":"https://opc.beizhux.com/content/3385/push-attribution-for-commits-in-limited-public-preview","private_fields_excluded":true}}