Wouldn't it be possible for the troll to temporarily set his username to the same as yours in his git config, make a few commits, and then push them, thereby making it look like you had made a contribution to the project? Would this make your "membership" in the project appear publicly?
Or does Github track pushes by the pusher's Github username?
I think it tracks everything with the public key that you use to push to github. The username will look the same, but will not be linked to your account.
Or does Github track pushes by the pusher's Github username?