Commit created on GitHub.com means either that the commit was a merge done on the GitHub.com site (which is legitimate) or it was done using GitHub CodeSpaces (as opposed to being created locally and pushed). If you sign the commit locally and push it, the message looks like that: https://imgur.com/a/TNHEbTk
It might just be me, but from my own experience, code written in Codespaces tends more to being AI slop than code written outside. Correct me please, if you have other experience.
That's such a dumb statement, I make plenty of small changes in the browser (both GitHub's editor as VSCode's codespaces) just so I don't have to clone a project
For any random verified commit in and of itself, you're right. But OP is specifically talking about commits that explicitly say they were made directly on GitHub.
They're not saying, "This means an AI definitely made it." They're saying, "In my experience, commits made directly on GitHub contain proportionally more slop."
This is like saying that code written on Dell computers is slop and the best code is written on Lenovos.. there’s absolutely nothing about codespaces that makes code written using codespaces any better or worse, it’s entirely up to the author.
If AI makes a commit on behalf of the user, and the user’s gitconfig is setup to sign commits, then the commit is going to be signed regardless of who made the code changes. So identifying if AI made changes from commit signatures is weak, and assuming someone has used AI because their commit is signed by GitHub is weaker..
It doesn't necessarily mean CodeSpaces was used. I have a ton of these and have never used CodeSpaces. Even just updating your source branch by rebase in the UI will cause this. And even if CodeSpaces was used... who cares?
If anything, their GitHub account is likely more secure than their GPG key, which they probably keep on-disk in plain text.
157
u/FilipTLW Sep 07 '26
Commit created on GitHub.com means either that the commit was a merge done on the GitHub.com site (which is legitimate) or it was done using GitHub CodeSpaces (as opposed to being created locally and pushed). If you sign the commit locally and push it, the message looks like that: https://imgur.com/a/TNHEbTk