Hacker News Reader

I can imagine a scenario where a malicious employee is intentionally injecting malicious code (backdoor, whatever) and wants that commit tied back to someone else (their enemy, boss).

View on HN

If they have push access, would github log who actually pushed it (i.e. ssh key)?

Yes, Github's authenticated push logs will tell you that. However, Github won't make those public, because they consider user identification private info.

(Or at least they won't provide those push logs to the Apache Software Foundation, which is how I know this.)

They won't even give it to the owner of the repo in question?

They will not. For instance, the ASF cannot get the push logs for all the repositories under <https://github.com/apache>.

Reply on news.ycombinator.com