GitHub 推送归属公开预览：新增 Committer 必须匹配 Pusher 规则
Push attribution for commits in limited public preview
核心代码托管平台引入破坏性安全约束，强制校验提交者与推送者一致性，直接影响 CI/CD 流水线与自动化脚本配置，建议相关团队立即评估并适配新规则。
GitHub now durably records the authenticated user who pushed each commit and surfaces that pusher identity in the UI and API alongside the existing author and committer fields.
GitHub 现在持久记录推送每个提交的经过身份验证的用户，并在 UI 和 API 中与现有的作者（author）和提交者（committer）字段一起展示该推送者身份。
Commit author and committer fields are just strings that the pushing client supplies, so anyone with write access to a repository can set them to any name and email they choose. That makes it possible for an attacker who compromises a low-privilege account to forge commits that appear to come from a trusted maintainer, evading review policies and confusing audit trails. GitHub already authenticates pushes. This release adds durable, per-commit pusher attribution alongside the author and committer metadata.
提交作者和提交者字段只是由推送客户端提供的字符串，因此任何拥有仓库写入权限的人都可以将它们设置为任意名称和邮箱。这使得攻击者在攻陷低权限账户后，能够伪造看似来自受信任维护者的提交，从而规避审查策略并混淆审计轨迹。GitHub 已经对推送进行了身份验证。本次发布在作者和提交者元数据之外，增加了持久的、逐提交的推送者归属信息。
With this release:
通过本次发布：
- Every commit pushed to a repository now has a durable, authenticated pusher identity attached to it, independent of whatever the author and committer metadata claims.
- A new repository rule condition, Committer must match pusher, blocks pushes where the committer metadata doesn’t match any verified email address of the authenticated pusher. This closes a path for commit identity spoofing.
- 现在推送到仓库的每个提交都附带了持久的、经过身份验证的推送者身份，无论作者和提交者元数据声称的是什么。
- 新增了一个仓库规则条件“Committer must match pusher”（提交者必须与推送者匹配），它会阻止那些提交者元数据与经过身份验证的推送者的任何已验证电子邮件地址不匹配的推送。这关闭了一条提交身份仿冒的路径。
You can use the pusher identity to spot-check suspicious activity or speed up security investigations instead of relying on unverified metadata. You can do this because the pusher identity is now visible wherever commits are shown instead. To enforce stricter identity requirements on a repository, add the new Committer must match pusher rule to a ruleset.
您可以使用推送者身份来抽查可疑活动或加快安全调查速度，而无需依赖未经身份验证的元数据。由于推送者身份现在在显示提交的地方可见，因此您可以做到这一点。若要在仓库上实施更严格的身份要求，请将新的“Committer must match pusher”规则添加到规则集中。
Push attribution is available now as a limited public preview for GitHub Enterprise customers. If you are interested in joining the preview, please contact your account team and request access.
推送归属功能现已作为 GitHub Enterprise 客户的有限公共预览版提供。如果您有兴趣加入预览，请联系您的客户团队并申请访问权限。
Learn more about configuring push rulesets.
了解更多关于配置推送规则集的信息。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力