git-commit-guard 0.22.2__tar.gz → 0.22.3__tar.gz

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/.github/workflows/coverage-baseline.yml

@@ -16,7 +16,7 @@ jobs:
           persist-credentials: false
       - name: Install uv
         # yamllint disable-line rule:line-length
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # ratchet:astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # ratchet:astral-sh/setup-uv@v8.2.0
       - name: Cache NLTK data
         # yamllint disable-line rule:line-length
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
@@ -27,7 +27,7 @@ jobs:
         run: uv run --dev pytest tests/ --cov=git_commit_guard --cov-report=xml
       - name: Upload coverage baseline
         # yamllint disable-line rule:line-length
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # ratchet:actions/upload-artifact@v7
         with:
           name: main-coverage
           path: coverage.xml

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/.github/workflows/coverage-comment.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Download artifact
         # yamllint disable-line rule:line-length
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # ratchet:actions/download-artifact@v8
         with:
           run-id: ${{ github.event.workflow_run.id }}
           name: pr
@@ -57,7 +57,7 @@ jobs:
       - name: Download baseline coverage
         if: steps.baseline.outputs.run-id != ''
         # yamllint disable-line rule:line-length
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # ratchet:actions/download-artifact@v8
         with:
           run-id: ${{ steps.baseline.outputs.run-id }}
           name: main-coverage

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/.github/workflows/lint-commits.yml

@@ -22,6 +22,6 @@ jobs:
           key: nltk-averaged-perceptron-tagger-punkt
       - name: Lint commits
         # yamllint disable-line rule:line-length
-        uses: benner/commit-guard@9162df75e7a6eba395bf7c07c1a0952fc6d04ea0  # v0.22.1
+        uses: benner/commit-guard@e156ca25789cc1824f745d74209f9c2654135dca  # v0.22.2
         with:
           range: origin/${{ github.base_ref }}..HEAD

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/.github/workflows/lint-md.yml

@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
       - name: Set up uv
         # yamllint disable-line rule:line-length
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
         with:
           enable-cache: false
       - name: Set up reviewdog

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/.github/workflows/lint-workflows.yml

@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
       - name: Set up uv
         # yamllint disable-line rule:line-length
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # ratchet:astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # ratchet:astral-sh/setup-uv@v8.2.0
       - name: Set up reviewdog
         # yamllint disable-line rule:line-length
         uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f  # ratchet:reviewdog/action-setup@v1
@@ -59,7 +59,7 @@ jobs:
           persist-credentials: false
       - name: Set up uv
         # yamllint disable-line rule:line-length
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # ratchet:astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # ratchet:astral-sh/setup-uv@v8.2.0
       - name: Set up reviewdog
         # yamllint disable-line rule:line-length
         uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f  # ratchet:reviewdog/action-setup@v1

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0
       - name: Set up uv
         # yamllint disable-line rule:line-length
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
         with:
           enable-cache: false
       - name: Build package

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/.github/workflows/security-audit.yml

@@ -17,6 +17,8 @@ jobs:
           persist-credentials: false
       - name: Install uv
         # yamllint disable-line rule:line-length
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
       - name: Audit dependencies
-        run: uv audit --frozen --preview-features audit-command
+        run: >-
+          uv audit --frozen --preview-features audit-command
+          --ignore-until-fixed GHSA-p4gq-832x-fm9v

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/.github/workflows/test.yml

@@ -15,7 +15,7 @@ jobs:
           persist-credentials: false
       - name: Install uv
         # yamllint disable-line rule:line-length
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
       - name: Cache NLTK data
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
         with:
@@ -35,7 +35,7 @@ jobs:
           cp coverage.xml ./pr/
       - name: Upload PR artifact
         # yamllint disable-line rule:line-length
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # ratchet:actions/upload-artifact@v7
         with:
           name: pr
           path: pr/

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-commit-guard
-Version: 0.22.2
+Version: 0.22.3
 Summary: Opinionated conventional commit message linter with imperative mood detection
 Project-URL: Homepage, https://github.com/benner/commit-guard
 Project-URL: Repository, https://github.com/benner/commit-guard
@@ -36,7 +36,7 @@ Opinionated conventional commit message linter with imperative mood detection.
   verb, verified via nltk POS tagging — not a hand-coded regex of "bad"
   words.
 * **Signature verification without a local keyring.** Resolves the commit
-  author via the GitHub API and verifies GPG/SSH against their published
+  committer via the GitHub API and verifies GPG/SSH against their published
   `.gpg`/`.keys` — no per-runner key management.
 * **Strict by default.** Subject format, body, trailers, `Signed-off-by`,
   and signature all enforced out of the box; opt out with `--disable`.
@@ -242,7 +242,7 @@ independently of `--enable`/`--disable`.
 The `signature` check verifies the commit without any local keyring setup:
 
 1. If the repo has a GitHub remote, call the Commits API
-   (`GET /repos/{owner}/{repo}/commits/{sha}`) to resolve the author's GitHub
+   (`GET /repos/{owner}/{repo}/commits/{sha}`) to resolve the committer's GitHub
    username — this works for corporate emails, noreply addresses, or any email
    not listed publicly on a GitHub profile.
 2. If the Commits API is unavailable (no GitHub remote, commit not yet pushed,
@@ -250,7 +250,7 @@ The `signature` check verifies the commit without any local keyring setup:
    (`{id}+{username}@users.noreply.github.com` or
    `{username}@users.noreply.github.com`) — no API call needed.
 3. If neither of the above resolves a username, fall back to searching GitHub
-   by the commit author's email.
+   by the commit committer's email.
 4. Fetch the resolved user's public keys from `github.com/{username}.gpg`
    (GPG) and the `/users/{username}/ssh_signing_keys` API (SSH keys tagged
    with the **Signing key** role). Auth-only SSH keys are deliberately not
@@ -261,7 +261,7 @@ The `signature` check verifies the commit without any local keyring setup:
    `git verify-commit` with the SSH allowed-signers config.
 7. If any key verifies, the check passes. If none do, it fails.
 
-If the author cannot be resolved via either method, or the GitHub API is
+If the committer cannot be resolved via either method, or the GitHub API is
 unreachable, the check fails with a clear error.
 
 For private repositories, set `GITHUB_TOKEN` or `GH_TOKEN` so the Commits API
@@ -316,7 +316,7 @@ COMMIT_GUARD_GIT_TIMEOUT=30 commit-guard --range origin/main..HEAD
 In GitHub Actions, set it at the step or job level:
 
 ```yaml
-- uses: benner/commit-guard@v0.22.2
+- uses: benner/commit-guard@v0.22.3
   env:
     COMMIT_GUARD_GIT_TIMEOUT: 30
   with:
@@ -400,7 +400,7 @@ steps:
   - uses: actions/checkout@v4
     with:
       fetch-depth: 0
-  - uses: benner/commit-guard@v0.22.2
+  - uses: benner/commit-guard@v0.22.3
 ```
 
 Check all commits in a pull request:
@@ -416,7 +416,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
 ```
@@ -424,7 +424,7 @@ jobs:
 Check a specific commit SHA (mirrors the positional CLI argument):
 
 ```yaml
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         with:
           rev: ${{ github.sha }}
 ```
@@ -442,7 +442,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature
@@ -462,7 +462,7 @@ jobs:
 When `output-file` is set the action exposes the path as an output:
 
 ```yaml
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -478,7 +478,7 @@ Add to your `.pre-commit-config.yaml`:
 ---
 repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.22.2
+    rev: v0.22.3
     hooks:
       - id: commit-guard
       - id: commit-guard-signature

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/README.md

@@ -15,7 +15,7 @@ Opinionated conventional commit message linter with imperative mood detection.
   verb, verified via nltk POS tagging — not a hand-coded regex of "bad"
   words.
 * **Signature verification without a local keyring.** Resolves the commit
-  author via the GitHub API and verifies GPG/SSH against their published
+  committer via the GitHub API and verifies GPG/SSH against their published
   `.gpg`/`.keys` — no per-runner key management.
 * **Strict by default.** Subject format, body, trailers, `Signed-off-by`,
   and signature all enforced out of the box; opt out with `--disable`.
@@ -221,7 +221,7 @@ independently of `--enable`/`--disable`.
 The `signature` check verifies the commit without any local keyring setup:
 
 1. If the repo has a GitHub remote, call the Commits API
-   (`GET /repos/{owner}/{repo}/commits/{sha}`) to resolve the author's GitHub
+   (`GET /repos/{owner}/{repo}/commits/{sha}`) to resolve the committer's GitHub
    username — this works for corporate emails, noreply addresses, or any email
    not listed publicly on a GitHub profile.
 2. If the Commits API is unavailable (no GitHub remote, commit not yet pushed,
@@ -229,7 +229,7 @@ The `signature` check verifies the commit without any local keyring setup:
    (`{id}+{username}@users.noreply.github.com` or
    `{username}@users.noreply.github.com`) — no API call needed.
 3. If neither of the above resolves a username, fall back to searching GitHub
-   by the commit author's email.
+   by the commit committer's email.
 4. Fetch the resolved user's public keys from `github.com/{username}.gpg`
    (GPG) and the `/users/{username}/ssh_signing_keys` API (SSH keys tagged
    with the **Signing key** role). Auth-only SSH keys are deliberately not
@@ -240,7 +240,7 @@ The `signature` check verifies the commit without any local keyring setup:
    `git verify-commit` with the SSH allowed-signers config.
 7. If any key verifies, the check passes. If none do, it fails.
 
-If the author cannot be resolved via either method, or the GitHub API is
+If the committer cannot be resolved via either method, or the GitHub API is
 unreachable, the check fails with a clear error.
 
 For private repositories, set `GITHUB_TOKEN` or `GH_TOKEN` so the Commits API
@@ -295,7 +295,7 @@ COMMIT_GUARD_GIT_TIMEOUT=30 commit-guard --range origin/main..HEAD
 In GitHub Actions, set it at the step or job level:
 
 ```yaml
-- uses: benner/commit-guard@v0.22.2
+- uses: benner/commit-guard@v0.22.3
   env:
     COMMIT_GUARD_GIT_TIMEOUT: 30
   with:
@@ -379,7 +379,7 @@ steps:
   - uses: actions/checkout@v4
     with:
       fetch-depth: 0
-  - uses: benner/commit-guard@v0.22.2
+  - uses: benner/commit-guard@v0.22.3
 ```
 
 Check all commits in a pull request:
@@ -395,7 +395,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
 ```
@@ -403,7 +403,7 @@ jobs:
 Check a specific commit SHA (mirrors the positional CLI argument):
 
 ```yaml
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         with:
           rev: ${{ github.sha }}
 ```
@@ -421,7 +421,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature
@@ -441,7 +441,7 @@ jobs:
 When `output-file` is set the action exposes the path as an output:
 
 ```yaml
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -457,7 +457,7 @@ Add to your `.pre-commit-config.yaml`:
 ---
 repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.22.2
+    rev: v0.22.3
     hooks:
       - id: commit-guard
       - id: commit-guard-signature

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/docs/index.html

@@ -315,7 +315,7 @@
           </li>
           <li>
             <strong>Signature verification without a local keyring.</strong>
-            Resolves the commit author via the GitHub API and verifies GPG/SSH
+            Resolves the commit committer via the GitHub API and verifies GPG/SSH
             against their published <code>.gpg</code>/<code>.keys</code> — no
             per-runner key management.
           </li>
@@ -456,7 +456,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
         <ol>
           <li>If the repo has a GitHub remote, call the Commits API
             (<code>GET /repos/{owner}/{repo}/commits/{sha}</code>) to resolve
-            the author's GitHub username — works for corporate emails, noreply
+            the committer's GitHub username — works for corporate emails, noreply
             addresses, or any email not listed publicly on a GitHub profile.</li>
           <li>If the Commits API is unavailable (no GitHub remote, commit not
             yet pushed, or API error), parse the username directly from a
@@ -464,7 +464,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
             (<code>{id}+{username}@users.noreply.github.com</code>) — no API
             call needed.</li>
           <li>If neither of the above resolves a username, fall back to
-            searching GitHub by the commit author's email.</li>
+            searching GitHub by the commit committer's email.</li>
           <li>Fetch the resolved user's public keys from
             <code>github.com/{username}.gpg</code> (GPG) and
             <code>/users/{username}/ssh_signing_keys</code> (SSH keys tagged
@@ -476,7 +476,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
           <li>Pass if any key verifies; fail if none do.</li>
         </ol>
         <p>
-          If the author cannot be resolved via either method, or the GitHub API
+          If the committer cannot be resolved via either method, or the GitHub API
           is unreachable, the check fails with a clear error. For private
           repositories, set <code>GITHUB_TOKEN</code> or <code>GH_TOKEN</code>
           so the Commits API can authenticate. The official GitHub Action wires
@@ -566,13 +566,13 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.2
+      - uses: benner/commit-guard@v0.22.3
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature</code></pre>
 
         <p>Check a specific commit SHA:</p>
-        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.22.2
+        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.22.3
         with:
           rev: ${{ github.sha }}</code></pre>
 
@@ -591,7 +591,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
           When <code>output-file</code> is set the action exposes the path as
           a step output, making JSONL results available to subsequent steps:
         </p>
-        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.22.2
+        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.22.3
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -604,7 +604,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
         <p>Add to <code>.pre-commit-config.yaml</code>:</p>
         <pre><code class="language-yaml">repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.22.2
+    rev: v0.22.3
     hooks:
       - id: commit-guard
       - id: commit-guard-signature</code></pre>

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/src/git_commit_guard/__init__.py

@@ -295,9 +295,9 @@ def check_required_trailers(message, required, result):
             result.error(f"missing required trailer: {trailer}")
 
 
-def _get_author_email(rev):
+def _get_committer_email(rev):
     return subprocess.check_output(  # noqa: S603
-        ["git", "log", "-1", "--format=%ae", rev],  # noqa: S607
+        ["git", "log", "-1", "--format=%ce", rev],  # noqa: S607
         text=True,
         stderr=subprocess.PIPE,
         timeout=_git_timeout(),
@@ -320,7 +320,7 @@ def _get_github_remote_info():
     return match.group("owner"), match.group("repo")
 
 
-def _fetch_github_commit_author(owner, repo, sha):
+def _fetch_github_commit_committer(owner, repo, sha):
     url = f"https://api.github.com/repos/{owner}/{repo}/commits/{sha}"
     headers = {"Accept": "application/vnd.github+json"}
     token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
@@ -329,8 +329,8 @@ def _fetch_github_commit_author(owner, repo, sha):
     req = urllib.request.Request(url, headers=headers)  # noqa: S310 Audit URL open for permitted schemes
     with urllib.request.urlopen(req, timeout=_git_timeout()) as resp:  # noqa: S310 Audit URL open for permitted schemes
         data = json.loads(resp.read())
-    author = data.get("author")
-    return author["login"] if author else None
+    committer = data.get("committer")
+    return committer["login"] if committer else None
 
 
 def _parse_noreply_username(email):
@@ -435,7 +435,7 @@ def _resolve_github_username(rev, email):
     if remote:
         owner, repo = remote
         try:
-            username = _fetch_github_commit_author(owner, repo, rev)
+            username = _fetch_github_commit_committer(owner, repo, rev)
         except urllib.error.HTTPError as e:
             if e.code == HTTPStatus.NOT_FOUND:
                 commits_api_404 = True
@@ -450,24 +450,24 @@ def _resolve_github_username(rev, email):
     return username, commits_api_404
 
 
-def _author_not_found_message(commits_api_404):
+def _committer_not_found_message(commits_api_404):
     had_token = bool(os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN"))
     if commits_api_404 and not had_token:
         return (
-            "commit author not found on GitHub — if the repo is private, "
+            "committer not found on GitHub — if the repo is private, "
             "set GITHUB_TOKEN in the workflow step "
             "(env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }})"
         )
-    return "commit author not found on GitHub — cannot verify signature"
+    return "committer not found on GitHub — cannot verify signature"
 
 
 def check_signature(rev, result):
     try:
-        email = _get_author_email(rev)
+        email = _get_committer_email(rev)
         username, commits_api_404 = _resolve_github_username(rev, email)
         if username is None:
             result.error(
-                _author_not_found_message(commits_api_404),
+                _committer_not_found_message(commits_api_404),
                 check=Check.SIGNATURE,
             )
             return

{git_commit_guard-0.22.2 → git_commit_guard-0.22.3}/tests/test_git_commit_guard.py

@@ -15,12 +15,12 @@ from git_commit_guard import (
     Result,
     _download_if_missing,
     _ensure_nltk_data,
-    _fetch_github_commit_author,
+    _fetch_github_commit_committer,
     _fetch_github_keys,
     _fetch_github_signing_keys,
     _fetch_github_username,
     _fetch_url,
-    _get_author_email,
+    _get_committer_email,
     _get_github_remote_info,
     _get_message,
     _get_range_revs,
@@ -625,13 +625,14 @@ class TestDownloadIfMissing:
         mock_dl.assert_called_once_with("punkt_tab", quiet=True)
 
 
-class TestGetAuthorEmail:
+class TestGetCommitterEmail:
     def test_returns_stripped_email(self):
         with patch(
             "git_commit_guard.subprocess.check_output",
             return_value="user@example.com\n",
-        ):
-            assert _get_author_email("abc123") == "user@example.com"
+        ) as mock_check:
+            assert _get_committer_email("abc123") == "user@example.com"
+        assert "--format=%ce" in mock_check.call_args.args[0]
 
 
 class TestFetchUrl:
@@ -716,7 +717,7 @@ class TestGetGithubRemoteInfo:
             assert _get_github_remote_info() is None
 
 
-class TestFetchGithubCommitAuthor:
+class TestFetchGithubCommitCommitter:
     def _mock_response(self, data):
         mock_resp = MagicMock()
         mock_resp.__enter__ = lambda s: s
@@ -724,20 +725,31 @@ class TestFetchGithubCommitAuthor:
         mock_resp.read.return_value = json.dumps(data).encode()
         return mock_resp
 
-    def test_returns_author_login(self):
-        resp = self._mock_response({"author": {"login": "commituser"}})
+    def test_returns_committer_login(self):
+        resp = self._mock_response({"committer": {"login": "commituser"}})
+        with patch("git_commit_guard.urllib.request.urlopen", return_value=resp):
+            assert (
+                _fetch_github_commit_committer("owner", "repo", "abc123")
+                == "commituser"
+            )
+
+    def test_returns_committer_login_not_author(self):
+        resp = self._mock_response(
+            {"author": {"login": "the-author"}, "committer": {"login": "the-committer"}}
+        )
         with patch("git_commit_guard.urllib.request.urlopen", return_value=resp):
             assert (
-                _fetch_github_commit_author("owner", "repo", "abc123") == "commituser"
+                _fetch_github_commit_committer("owner", "repo", "abc123")
+                == "the-committer"
             )
 
-    def test_null_author_returns_none(self):
-        resp = self._mock_response({"author": None})
+    def test_null_committer_returns_none(self):
+        resp = self._mock_response({"committer": None})
         with patch("git_commit_guard.urllib.request.urlopen", return_value=resp):
-            assert _fetch_github_commit_author("owner", "repo", "abc123") is None
+            assert _fetch_github_commit_committer("owner", "repo", "abc123") is None
 
     def test_github_token_sent_in_header(self):
-        resp = self._mock_response({"author": {"login": "user"}})
+        resp = self._mock_response({"committer": {"login": "user"}})
         captured = []
 
         def mock_urlopen(req, **_):
@@ -748,11 +760,11 @@ class TestFetchGithubCommitAuthor:
             patch("git_commit_guard.urllib.request.urlopen", side_effect=mock_urlopen),
             patch.dict("os.environ", {"GITHUB_TOKEN": "mytoken"}, clear=False),
         ):
-            _fetch_github_commit_author("owner", "repo", "abc123")
+            _fetch_github_commit_committer("owner", "repo", "abc123")
         assert captured[0].get_header("Authorization") == "Bearer mytoken"
 
     def test_gh_token_used_when_github_token_absent(self):
-        resp = self._mock_response({"author": {"login": "user"}})
+        resp = self._mock_response({"committer": {"login": "user"}})
         captured = []
 
         def mock_urlopen(req, **_):
@@ -765,7 +777,7 @@ class TestFetchGithubCommitAuthor:
             patch("git_commit_guard.urllib.request.urlopen", side_effect=mock_urlopen),
             patch.dict("os.environ", env, clear=True),
         ):
-            _fetch_github_commit_author("owner", "repo", "abc123")
+            _fetch_github_commit_committer("owner", "repo", "abc123")
         assert captured[0].get_header("Authorization") == "Bearer ghtoken"
 
 
@@ -894,7 +906,7 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
             patch("git_commit_guard._fetch_github_username", return_value="testuser"),
@@ -909,7 +921,7 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
             patch("git_commit_guard._fetch_github_username", return_value="testuser"),
@@ -925,7 +937,7 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
             patch("git_commit_guard._fetch_github_username", return_value="testuser"),
@@ -940,7 +952,7 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
             patch("git_commit_guard._fetch_github_username", return_value=None),
@@ -956,14 +968,14 @@ class TestCheckSignature:
         }
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch(
                 "git_commit_guard._get_github_remote_info",
                 return_value=("owner", "repo"),
             ),
             patch(
-                "git_commit_guard._fetch_github_commit_author",
+                "git_commit_guard._fetch_github_commit_committer",
                 side_effect=urllib.error.HTTPError(
                     url="", code=404, msg="Not Found", hdrs=None, fp=None
                 ),
@@ -979,14 +991,14 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch(
                 "git_commit_guard._get_github_remote_info",
                 return_value=("owner", "repo"),
             ),
             patch(
-                "git_commit_guard._fetch_github_commit_author",
+                "git_commit_guard._fetch_github_commit_committer",
                 side_effect=urllib.error.HTTPError(
                     url="", code=404, msg="Not Found", hdrs=None, fp=None
                 ),
@@ -1003,14 +1015,14 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch(
                 "git_commit_guard._get_github_remote_info",
                 return_value=("owner", "repo"),
             ),
             patch(
-                "git_commit_guard._fetch_github_commit_author",
+                "git_commit_guard._fetch_github_commit_committer",
                 side_effect=urllib.error.HTTPError(
                     url="", code=500, msg="Server Error", hdrs=None, fp=None
                 ),
@@ -1026,14 +1038,14 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch(
                 "git_commit_guard._get_github_remote_info",
                 return_value=("owner", "repo"),
             ),
             patch(
-                "git_commit_guard._fetch_github_commit_author",
+                "git_commit_guard._fetch_github_commit_committer",
                 side_effect=urllib.error.HTTPError(
                     url="", code=401, msg="Unauthorized", hdrs=None, fp=None
                 ),
@@ -1047,14 +1059,14 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch(
                 "git_commit_guard._get_github_remote_info",
                 return_value=("owner", "repo"),
             ),
             patch(
-                "git_commit_guard._fetch_github_commit_author",
+                "git_commit_guard._fetch_github_commit_committer",
                 side_effect=urllib.error.HTTPError(
                     url="", code=403, msg="Forbidden", hdrs=None, fp=None
                 ),
@@ -1068,7 +1080,7 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="corp@example.com"
+                "git_commit_guard._get_committer_email", return_value="corp@example.com"
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
             patch(
@@ -1086,7 +1098,7 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="corp@example.com"
+                "git_commit_guard._get_committer_email", return_value="corp@example.com"
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
             patch(
@@ -1103,7 +1115,7 @@ class TestCheckSignature:
     def test_url_error_fails(self):
         r = Result()
         with patch(
-            "git_commit_guard._get_author_email",
+            "git_commit_guard._get_committer_email",
             side_effect=urllib.error.URLError("unreachable"),
         ):
             check_signature("abc123", r)
@@ -1112,7 +1124,7 @@ class TestCheckSignature:
 
     def test_timeout_error_fails(self):
         r = Result()
-        with patch("git_commit_guard._get_author_email", side_effect=TimeoutError()):
+        with patch("git_commit_guard._get_committer_email", side_effect=TimeoutError()):
             check_signature("abc123", r)
         assert not r.ok
         assert any("API unreachable" in msg for _, _, msg in r.errors)
@@ -1120,7 +1132,7 @@ class TestCheckSignature:
     def test_subprocess_timeout_fails_gracefully(self):
         r = Result()
         with patch(
-            "git_commit_guard._get_author_email",
+            "git_commit_guard._get_committer_email",
             side_effect=subprocess.TimeoutExpired(cmd="git", timeout=10),
         ):
             check_signature("abc123", r)
@@ -1131,14 +1143,15 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="corp@example.com"
+                "git_commit_guard._get_committer_email", return_value="corp@example.com"
             ),
             patch(
                 "git_commit_guard._get_github_remote_info",
                 return_value=("owner", "repo"),
             ),
             patch(
-                "git_commit_guard._fetch_github_commit_author", return_value="corpuser"
+                "git_commit_guard._fetch_github_commit_committer",
+                return_value="corpuser",
             ),
             patch("git_commit_guard._fetch_github_username") as mock_email_search,
             patch("git_commit_guard._fetch_github_keys", return_value=("GPG KEY", "")),
@@ -1152,14 +1165,14 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="corp@example.com"
+                "git_commit_guard._get_committer_email", return_value="corp@example.com"
             ),
             patch(
                 "git_commit_guard._get_github_remote_info",
                 return_value=("owner", "repo"),
             ),
             patch(
-                "git_commit_guard._fetch_github_commit_author",
+                "git_commit_guard._fetch_github_commit_committer",
                 side_effect=urllib.error.URLError("not found"),
             ),
             patch("git_commit_guard._fetch_github_username", return_value="emailuser"),
@@ -1169,17 +1182,17 @@ class TestCheckSignature:
             check_signature("abc123", r)
         assert r.ok
 
-    def test_commits_api_null_author_falls_back_to_email_search(self):
+    def test_commits_api_null_committer_falls_back_to_email_search(self):
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch(
                 "git_commit_guard._get_github_remote_info",
                 return_value=("owner", "repo"),
             ),
-            patch("git_commit_guard._fetch_github_commit_author", return_value=None),
+            patch("git_commit_guard._fetch_github_commit_committer", return_value=None),
             patch("git_commit_guard._fetch_github_username", return_value="emailuser"),
             patch("git_commit_guard._fetch_github_keys", return_value=("", "SSH KEY")),
             patch("git_commit_guard._verify_gpg", return_value=False),
@@ -1192,10 +1205,12 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
-            patch("git_commit_guard._fetch_github_commit_author") as mock_commits_api,
+            patch(
+                "git_commit_guard._fetch_github_commit_committer"
+            ) as mock_commits_api,
             patch("git_commit_guard._fetch_github_username", return_value="emailuser"),
             patch("git_commit_guard._fetch_github_keys", return_value=("GPG KEY", "")),
             patch("git_commit_guard._verify_gpg", return_value=True),
@@ -1208,7 +1223,7 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email",
+                "git_commit_guard._get_committer_email",
                 return_value="12345678+alice@users.noreply.github.com",
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
@@ -1224,7 +1239,7 @@ class TestCheckSignature:
         r = Result()
         with (
             patch(
-                "git_commit_guard._get_author_email",
+                "git_commit_guard._get_committer_email",
                 return_value="12345678+alice@users.noreply.github.com",
             ),
             patch(
@@ -1232,7 +1247,7 @@ class TestCheckSignature:
                 return_value=("owner", "repo"),
             ),
             patch(
-                "git_commit_guard._fetch_github_commit_author",
+                "git_commit_guard._fetch_github_commit_committer",
                 side_effect=urllib.error.URLError("not found"),
             ),
             patch("git_commit_guard._fetch_github_username") as mock_email_search,
@@ -1630,7 +1645,7 @@ class TestMain:
             patch("sys.argv", ["cg", "abc123", "--enable", "signature"]),
             patch("git_commit_guard._get_message", return_value=_VALID_MSG),
             patch(
-                "git_commit_guard._get_author_email", return_value="user@example.com"
+                "git_commit_guard._get_committer_email", return_value="user@example.com"
             ),
             patch("git_commit_guard._get_github_remote_info", return_value=None),
             patch("git_commit_guard._fetch_github_username", return_value="testuser"),