Wow! Now I wonder how many bucks they paid for it.
Because for sure they didn't DMCAed their way to own that account, right? Right?
Oh no it's not done through that account. Seems to be some sort of ephemeral account scoped to the repo.
What's in authour/commit meta is orthogonal to which github.com account you are actually using. Anyone can commit as anyone as long as you have any way to push and if you want better than that you need signed commits. There are no "ephemeral accounts" in play here.
Right, that was my intended meaning of ephemeral accounts.
git require name and email to commit, but there's no cryptography involved there. Maybe GitHub won't green the lawn for unverified third party commits included in pushed commits?
For a little while someone added Claude’s noreply email address to their account, so their profile started appearing alongside private repo commits!