So you can trace for sure who made every commit, but you're saying an unauthorized actor can add a commit? Well you would detect that in the code review before

So you can trace for sure who made every commit, but you're saying an unauthorized actor can add a commit? Well you would detect that in the code review before the release.