CODEWITHSUNDEEP
gitgithub
Alexey
Alexey

Reputation: 919

Push dates of commits in github

Is it possible to see commits push dates in github? I tried this command git reflog --date=local origin/master, it does what I need if it is used in source repository but it doesn't show anything in cloned repository. Basically I need a way to show that I was the first to push the code I have written in github to mitigate situations when a scammer copies the code from my public repository and falsely claims ownership over it, however unlikely that might be. The commit dates themselves can't be used for this because they are local and can be tampered with in theory.

Upvotes: 3

Views: 2032

Answers (2)

Ciro Santilli OurBigBook.com
Ciro Santilli OurBigBook.com

Reputation: 384154

It is possible to get push dates (not commit dates) with the repository events API field created_at of PushEvent

E.g. https://api.github.com/repos/cirosantilli/cirosantilli.github.io/events lists events, some of which are "type": "PushEvent" e.g.:

  {
    "id": "41375032462",
    "type": "PushEvent",
    "actor": {
      "id": 1429315,
      "login": "cirosantilli",
      "display_login": "cirosantilli",
      "gravatar_id": "",
      "url": "https://api.github.com/users/cirosantilli",
      "avatar_url": "https://avatars.githubusercontent.com/u/1429315?"
    },
    "repo": {
      "id": 16453261,
      "name": "cirosantilli/cirosantilli.github.io",
      "url": "https://api.github.com/repos/cirosantilli/cirosantilli.github.io"
    },
    "payload": {
      "repository_id": 16453261,
      "push_id": 19952640091,
      "size": 3,
      "distinct_size": 0,
      "ref": "refs/heads/published",
      "head": "24bb4d121db3db4e5af29fb8f9bb29b5bcc5cc31",
      "before": "ff5c994982614d5cbd9e05b2a998b9fca3124521",
      "commits": [
        {
          "sha": "9ac9227d970a7b180a5795aa4e44f35764732e6f",
          "author": {
            "email": "[email protected]",
            "name": "Ciro Santilli"
          },
          "message": "bak",
          "distinct": false,
          "url": "https://api.github.com/repos/cirosantilli/cirosantilli.github.io/commits/9ac9227d970a7b180a5795aa4e44f35764732e6f"
        },
        {
          "sha": "84ab50b3154ee40b147aab43960c027b991413d5",
          "author": {
            "email": "[email protected]",
            "name": "Ciro Santilli"
          },
          "message": "bak",
          "distinct": false,
          "url": "https://api.github.com/repos/cirosantilli/cirosantilli.github.io/commits/84ab50b3154ee40b147aab43960c027b991413d5"
        },
        {
          "sha": "24bb4d121db3db4e5af29fb8f9bb29b5bcc5cc31",
          "author": {
            "email": "[email protected]",
            "name": "Ciro Santilli"
          },
          "message": "bak",
          "distinct": false,
          "url": "https://api.github.com/repos/cirosantilli/cirosantilli.github.io/commits/24bb4d121db3db4e5af29fb8f9bb29b5bcc5cc31"
        }
      ]
    },
    "public": true,
    "created_at": "2024-08-27T11:18:18Z"
  },

We can see in this example that the event shows which commits were pushed at a given time, which suggests it contains the push date rather than the date of commits, which could be multiple different dates.

Documented at: https://docs.github.com/en/rest/using-the-rest-api/github-event-types?apiVersion=2022-11-28

created_at: The date and time when the event was triggered. It is formatted according to ISO 8601.

Finding specific commit in event API

Does not seem possible with the GitHub API.

Maybe it will be possible with GitHub Archive: https://www.gharchive.org/ which exposes the event APIs as a Google BigQuery dataset. It has created_at for sure in a column, but not sure if the commits are indexed there however, they might be just embedded into the JSON payload.

I had some sample queries at: https://github.com/cirosantilli/all-github-commit-emails but things bitrotted a bit since and I'm lazy now.

There is also a new closely related dataset with ID bigquery-public-data.github_repos but I can't see the created_at easily there.

Related discussion: https://github.com/orgs/community/discussions/24730

Upvotes: 0

torek
torek

Reputation: 489648

What you can see from GitHub is whatever the folks who run GitHub choose to give you. GitHub Enterprise does offer push log information, and plain GitHub offers an audit log.

I tried [using] git reflog ...

That just shows you local reflog time stamps, generated by your own Git. So that won't help much.

The commit dates themselves can't be used for this because they are local and can be tampered with in theory.

Your concern is valid, but I think you are looking at this from the wrong angle. Changing the commit's date changes the commit. It's no longer the same commit. You have, instead, a new and different commit, with a different hash ID.1 The way this becomes an issue is that you make your commit, with your tree and metadata, and then competitor X can make his own (different) commit with your tree and his metadata, using arbitrary metadata, including an earlier timestamp.

Relying on GitHub to provide the time-stamps, though, is not going to help as much as you might like, I think. What you need is something that is actually enforceable in a legal sense, and—at least today—that's copyright law, which is recognized in a statistically significant portion of the world. The rules for using copyright law are not really in scope here on StackOverflow, though; law.stackexchange.com seems a much better fit.

1It's true that in theory you could break SHA-1 and come up with a new, consistent, valid commit with an adjusted date and yet the same hash ID. But the technique used for making two PDF files with the same hash ID must be modified to apply to commits, and will leave ridiculously-obvious fingerprints.

Upvotes: 2

Related Questions