You’ve since force pushed (the right solution today) to rewrite the commits to workaround the clabot papercut. To make sure I understood what copilot was doing and how our GitHub - psf/clabot: Python Software Foundation Contributor License Agreement Management Bot · GitHub triggers I went and looked at your earlier branch:
Your copilot created commits show up in git log as:
commit c4c841f0cb1690573734ee029309f110fa1e0e9d
Author: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Date: Sun Mar 22 13:42:31 2026 +0000
Improve error messages for bounded iteration on extended slice assignment
Co-authored-by: csm10495 <5749838+csm10495@users.noreply.github.com>
Agent-Logs-Url: https://github.com/csm10495/cpython/sessions/48a4582d-926d-44bf-aa9b-8078648099f4
It has nothing to do with the Co-authored-by: lines. Those are never considered. What clabot looks at is the Author: on a git commit. The GitHub UI tied your identity to it because GitHub (not git) offers something slightly more than git because it knows who’s account was used.
(that’s from Improve error messages for bounded iteration on extended slice assign… · python/cpython@c4c841f · GitHub until github garbage collects your old unreferenced commit)
The same kind of clabot “Who dis?” thing happens by default if you use Claude Code on the Web and do not tell it or configure it to commit with a different author line. It will have an Author line with the Claude noreply anthropic email address. (tip if you forgot: just ask your session to rewrite commit history to fix the author lines to your liking)
If you want to avoid this when using copilot for remote sandboxed development, try asking it to use your name and email on commit messages if it doesn’t already have a way for you to configure its sandboxed git client directly. For Claude on the web you can add relevant git config commands to the Environment setup script for the remote hosted sandbox it runs in.
These are all papercuts today when we use our modern replacement for IDEs. I think we could potentially improve the clabot here this to avoid the inaccurate “user has not signed the CLA” error response in this scenario when the driver of the system clearly has. That’ll require some care to make sure we’re getting it right.
Git is not an identity system. It is 100% free form text where any one can fill in anything they want. I can commit pretending to be Guido while Guido can commit pretending to be King Arthur. I’m pretty sure ShrubberyBot is secretly the Rabbit of Caerbannog. GitHub will happily show these as being authored by the account matching the arbitrary string any of us put in the author line. This is working as intended because identity is unsolvable.
The CLA bot is a practical attempt at conformance on our part. The other side of that is us as PR reviewers with a Merge button looking things over to be sure it makes sense. A PR put up by someone with commits having Author lines of others who are not present and involved would be suspicious and something we’re expected to catch and flag 
on our own.