Commit Attribution

When tools like createOrUpdateFile or mergePullRequest create commits, you can control how those commits are attributed. This is useful for AI agents, bots, and automated workflows where you want clear accountability.

AI assistant prompt (commit attribution)

Configure commit attribution in this @github-tools/sdk project: use coAuthors on createGithubTools or createGithubAgent to credit the bot or AI assistant on commits while keeping the human user as the primary author. See https://github-tools.com/guide/commit-attribution.

Understanding Git attribution

Git tracks three types of attribution on commits:

When using GitHub's API (which this SDK does), the default author and committer is the authenticated user (the owner of the token).

Add co-authors to commits

The most common pattern is keeping the human as author while crediting a bot or AI assistant as co-author:

import { createGithubTools } from '@github-tools/sdk'

const tools = createGithubTools({
  token: userToken,
  coAuthors: [
    { name: 'my-bot[bot]', email: '12345+my-bot[bot]@users.noreply.github.com' }
  ]
})

This appends a Co-authored-by trailer to every commit message:

Update README.md

Co-authored-by: my-bot[bot] <12345+my-bot[bot]@users.noreply.github.com>

GitHub recognizes these trailers and displays co-authors in the commit UI.

Override author and committer

You can also override the author and committer identity:

import { createGithubTools } from '@github-tools/sdk'

const tools = createGithubTools({
  token: botToken,
  author: { name: 'Jane Doe', email: 'jane@example.com' },
  committer: { name: 'my-bot[bot]', email: '12345+my-bot[bot]@users.noreply.github.com' }
})

Use with agents

The same options work with createGithubAgent and createDurableGithubAgent:

import { createGithubAgent } from '@github-tools/sdk'

const agent = createGithubAgent({
  model: 'anthropic/claude-sonnet-4.6',
  preset: 'maintainer',
  coAuthors: [
    { name: 'my-bot[bot]', email: '12345+my-bot[bot]@users.noreply.github.com' }
  ]
})

Commit signing

The SDK automatically attempts to create signed commits using GitHub's createCommitOnBranch GraphQL mutation. Whether commits are actually signed depends on your token type:

Signed commits show as "Verified" in the GitHub UI and satisfy branch protection rules requiring signed commits.

Why some tokens don't produce signed commits

GitHub only signs commits made by bots (GitHub Apps). When you authenticate as a user (OAuth or PAT), GitHub cannot sign on your behalf because it doesn't have access to your private signing key. The commit still works—it just won't be marked as "Verified."

For more details, see GitHub's commit signature verification docs.

Attribution patterns

External references

• GitHub: Creating a commit with multiple authors
• GitHub: About commit signature verification