Improper commit attribution

[joshaber]

Problem statements:

1. If the email in my Git config doesn't match any emails on my account in GitHub.com, commits I push are not properly attributed to my GitHub account.

2. Commits in my repository history are not attributed to a GitHub account, so I don't have confidence or peace of mind about who actually made the commit.

3. As a beginner to Git and GitHub, I don't understand why they're different or why my Git info might not match my GitHub info, and why it matters. This is just confusing. (from "Configure git" page unfriendly to beginners #4002)

4. If I sign out of my account and back in with a different GitHub account on the same machine, I may see an unexpected avatar based on my underlying Git email that doesn't match the GitHub account I'm signed in with (from Avatar doesn't update with other user logging on #6973)

5. I want to commit in some repositories with my personal email, and in other repositories with my work email (from Set commit e-mail by repository #9218). This is a slightly different version of (4) I think.

Considerations:

• Unexpected mismatches most frequently occur when people have a work email on their GitHub account and a personal email in their Git config, or visa versa.
• This can be solved by adding additional emails to your GitHub.com account to ensure that whatever is in your Git config matches one of them.
• We don't seem to currently update any changes from the remote in how we're rendering accounts locally. See: App does not refresh account info through API (e.g. name change) #3066

From @niik at #574 (review):

I was thinking about this one above-and-beyond thing we could do in the configuration step. If a user enters an email that's not associated with their GitHub account (assuming they've signed it) we could show a friendly warning and maybe a link to either add it or suggest one of the email addresses they have associated.

[shiftkey]

Or you can add an email address through the API and take away all the manual work...

[shiftkey]

#3876 was raised by @LitenUpNet as the user had switched accounts but user.email was an email address from the old account, which lead to some confusion. This is a separate flow to the Welcome Wizard, but it'd be nice to have a similar check at that point too.

[shiftkey]

Noodling on this idea some more, we could change the commit avatar to indicate there's a problem needing attention:

(Yes, I'm going to continue to abuse ⚠️ until someone arrests me or comes along with better design skills)

Clicking on this could show a dialog which then explains the situation and helps the user resolve this, e.g: "The email address you are using for this GitHub repository isn't associated with your GitHub account. Want to add it to your GitHub account now?"

This could also potentially also address:

• GitHub Enterprise repos need their own e-mail setting or default of LDAP account email #2829 - "This repository is a GitHub Enterprise repository but your global user.email setting is not associated with your account - would you like to override this locally to use your GitHub Enterprise email address?"
• git commits with machine name for user.email if missing config #1364 - "You don't have a user.email address set currently - want to set this using one in your GitHub account?"

[billygriffin]

This might also be relevant for #5686.

[steveward]

• Username shows up differently in the contributions section #6090 was a related case where a user made a typo in their email address which caused the commit to be attributed to the wrong user

[billygriffin]

Updated the original issue here to attempt to frame the problems. @niik Are you planning on looking at this in the context of #5686? If not, maybe @ampinsk could take a look at it as a smaller design task. It's something that @steveward brought up as still one of the most frequent causes of confusion for users.

[billygriffin]

@niik and I chatted about this this morning, and his exploration of the welcome flow in #5686 will indeed take the git config into account here to hopefully warn folks when they get set up on Desktop if there is a mismatch between their Git and GitHub setup.

Additionally, we think it would be reasonable to get some metrics in around percentage of commits (and absolute number) of commits in Desktop without attribution to see how widespread a problem it is and if it's worth tackling more broadly outside of just the welcome flow. I'm going to make a separate issue for metrics on that.

[billygriffin]

From @kaster14 in #6797:

On the github desktop app there are times where I need to make a commit from the company login. I go to file, options, then sign out, then sign in as the company account. The problem is that when I go to the changes tabon the mains screen and go to make a commit it still shows my personal account as making the commit (or at least shows my picture).

I find I also have to go to file, options, select the "git" tab, and change the information there to the company account, hit save, and then have to restart github desktop before the changes take place.

I would expect to be able to go to file, options, sign out, then sign in as the company profile and have commits immediately start being made from the company account without any further steps being needed.

[tierninho]

As part of an exercise I did a walk-though of setting up GitHub and Desktop as a "new" user. All was rather easy and straight-forward, expect for setting up and explanation of git.

Although we provide a short description in onboarding, I think we can do a better job of explaining its purpose and the distinction between GitHub and git.

There are a couple of ideas worth revisiting in #4002

It would be great to open up a dialogue again and see if any action items come out of it.

[kaster14]

As part of an exercise I did a walk-though of setting up GitHub and Desktop as a "new" user. All was rather easy and straight-forward, expect for setting up and explanation of git.

Although we provide a short description in onboarding, I think we can do a better job of explaining its purpose and the distinction between GitHub and git.

There are a couple of ideas worth revisiting in #4002

It would be great to open up a dialogue again and see if any action items come out of it.

@tierninho Could you elaborate or direct me to on what the difference is between git and github and how that applies to github desktop and commit attribution?

What I'm looking for is a single login point, it doesn't make sense that I have to log in and additionally as a second step configure the "git" tab.

[steveward]

@kaster14 GitHub uses the email in your .gitconfig to associate commits with your GitHub account. Configuring your name and email in Git is not any sort of authentication -- it's just metadata about who created the commit. This help article has some more information, but let me know if you have any specific questions.

[kaster14]

Thanks @steveward for the link - I guess I don't understand the need for an email address to be used. What I am looking for is: "I sign into github desktop then when I make commits I expect to see my account name and avatar picture with the commit in the history tab (of github desktop), that name/avatar I would expect to be based off of the account I used to sign into github desktop.
If a different name or email besides the account name is desired to be used that should be a global setting that is tied to my github account and not something local to an instance of github desktop.
I share a machine with a coworker so every time one of us signs in we have to change the "account" tab and "git" tab of github desktop, I would like to have that extra step removed.

[steveward]

GitHub Desktop does automatically use your name and email when you first log in through the application. We have also put in measures to detect if you are committing with an email address that is not associated with your current account. You will see a warning in the commit summary box and there is a dropdown to select a correct email address. #11760 is also tracking the ability to change the name in this field.

Support for multiple accounts is being tracked in #3707. You can follow along for updates about that.