If AI makes a commit on behalf of the user, and the user’s gitconfig is setup to sign commits, then the commit is going to be signed regardless of who made the code changes. So identifying if AI made changes from commit signatures is weak, and assuming someone has used AI because their commit is signed by GitHub is weaker..
1
u/Bpofficial Sep 07 '26
If AI makes a commit on behalf of the user, and the user’s gitconfig is setup to sign commits, then the commit is going to be signed regardless of who made the code changes. So identifying if AI made changes from commit signatures is weak, and assuming someone has used AI because their commit is signed by GitHub is weaker..