Unexpected commit authorization and attribution: Copilot App commit appears under my identity #5524

Short summary

Unexpected commit authorization and attribution: Copilot App commit appears under my identity

Affected version or release

November 6, 2026; exact Copilot App version unknown

Installation context

GitHub Copilot App acting on my behalf in repository https://github.com/ohhmm/openmind

What happened?

Copilot App created commit b1a052e63011ce196b93b924ce87c92184785615. GitHub displays my name/email as both author and committer, with Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>. The commit was merged. I did not intend to authorize the App to perform this write/merge and attribute the commit as if I were the author and committer. I cannot tell from the commit metadata whether the App used my personal credential, an app token, or another authorization mechanism. The change also lacked focused regression tests for the parsing behavior.

Please investigate the authorization and attribution path and clarify what action and merge permissions were granted. If the App performs a commit or merge, make the acting identity and authorization explicit, and provide clear controls to prevent commits or merges under the user's identity unless the user specifically authorizes that behavior.

Steps to reproduce

1. Use Copilot App on a repository with write/merge access.
2. Ask the App to make a code change.
3. Review the resulting commit metadata and repository history.
4. Observe that the commit is attributed to the user as author and committer, while Copilot App appears only as co-author.
5. In this case, observe that the commit was merged.

The exact App version and the precise authorization/configuration that enabled this action are not yet known.

Expected behavior

The App should clearly identify when it is acting as the user, disclose which authorization is used for commits and merges, and require explicit user consent before writing or merging under the user's identity. Commits should accurately and transparently represent the App's role. Users should be able to disable merge/write actions or require review/confirmation.

Additional context

Commit: ohhmm/openmind@b1a052e

Related Copilot App report: #5507

The referenced commit also mentions closing ohhmm/openmind#2293. I have not independently verified which credential or token performed the write/merge; please inspect the relevant App and GitHub audit/session records. Do not include secrets or credential values in any issue comments or logs.