Commit author attribution when using Private Mirrors App with GitHub Enterprise Managed Users (EMU)

[cb-pradeep]

Hi PMA team,

We're currently evaluating GitHub Enterprise Managed Users (EMU) together with the Private Mirrors App for our company's open source contribution workflow.

One question we couldn't find answered in the documentation is around author attribution.

Example:

• Enterprise Managed User: pradeep@company.com (managed via Okta/SCIM)
• Public GitHub account: pradeep123

A developer makes commits in the private mirror using their EMU identity.

When PMA synchronizes those commits to the public fork and a pull request is eventually opened upstream:

1. Is the original Git commit author (pradeep@company.com) preserved?
2. Will GitHub associate those commits with the developer's public GitHub account (pradeep123), or will they appear as an unlinked author because the commit email belongs to an EMU identity?
3. Does PMA provide any mechanism or recommended approach to map EMU identities to public GitHub identities while preserving individual contributor attribution?
4. If not, what is the recommended best practice for organizations that want engineers to receive proper public attribution for their OSS contributions?

Contributor attribution is an important consideration for our engineering organization, so we'd like to understand the recommended approach before adopting PMA.

Thanks!

[wrslatz]

👋 The attribution flow docs cover the available options here. Within an EMU enterprise, you would follow option 2. Users would log in with their EMU user but make their commits with the email associated with their public GitHub account.

Happy to consider documentation improvements to clarify things!

[cb-pradeep]

Thank you so much for the quick clarification! This answers exactly what we were trying to understand.

Just one follow-up question: Is configuring the Git commit email to the contributor's public GitHub account (while authenticating with the EMU account) the officially recommended and supported approach for production use? Are there any security or compliance considerations that organizations should be aware of when adopting this model?

[wrslatz]

Correct, that is the officially recommended approach. I am not aware of any security or compliance considerations or concerns with this approach.

[riley-kohler]

It is officially supported but whether it is recommended depends on your specific needs and use case. The main considerations when using external commit authors on your EMU org is enforcing it using branch protections on your contribution org if you want to avoid leaking internal commit authors externally, and ensuring that only merge commits are allowed by those branch protections since merge commits have a PMA flag to remove them during syncing but squashes or rebases would potentially leak the internal commit author (since you need to log in as the emu account to merge internal PRs).