Mysterious Contributor on my GitHub Repository: What Happened and How to Avoid It

Description and use

Unexpected contributors appeared in GitHub’s UI due to orphaned AI commits and force‑pushes. A step‑by‑step audit and author policy resolved the issue.

Problem

A repository shows unexpected contributors in the GitHub UI, suggesting a permission leak, but the issue is actually due to how GitHub counts contributors, force‑pushes, and AI‑generated commits.

Outcome

The repository’s contributor list was clarified; ghost contributors were identified as orphaned AI commits from force‑pushes. A clear audit workflow and team policy were established to prevent future confusion.

Workflow

• Identify discrepancy between UI pill and API/git log
• Determine if force‑push or orphaned commits exist
• Check co‑author trailers and author/committer identities
• Run git log --all --pretty="%an <%ae> | %cn <%ce>" | sort -u to list unique authors
• Compare with curl -s https://api.github.com/repos/<owner>/<repo>/contributors | jq '.[].login' and stats/contributors
• If mismatch, investigate orphaned commits via gh api repos/.../events --jq 'select(.payload.forced)'
• Adjust git config to set correct user.name and user.email
• Implement team policy on author identity, squash vs rebase, and force‑push usage
• Re‑push if necessary and wait for GitHub to recompute graphs
• Verify convergence of all four graphs (canonical, API, event, UI)
• Document findings and update troubleshooting table

Evidence

GitHub retains orphans for ~90 days for the PR timeline and the contributors graph, even though you can no longer fetch them.

Source

The pill is for discovery — it aggregates every author ever pushed to any ref, including branches you deleted.

Source