title: How to tell if a GitHub release was made securely
body: <p>Is it possible to tell if a release which is published on a GitHub repo was made by someone who logged in with 2FA?</p>
  
  <p>The reason for asking is that we have a tool that integrates GitHub releases (from repos made by other people, ie not part of our GitHub organisation) into an application, and is capable of auto-updating to the latest release.  </p>
  
  <p>Although it's user friendly to auto-update, if someone were to steal the credentials of that GitHub user (because they do not use 2FA) then the auto-update could end up installing maliciously crafted code.  This scenario has happened to npmjs.</p>
  
  <p>It would be useful to be able to identify that the release was made by someone who does not use 2FA and warn that the release might be "unsafe".</p>
  
  <p>Our application is part of Qooxdoo <a href="http://www.qooxdoo.org" rel="nofollow noreferrer">http://www.qooxdoo.org</a>, which is an open source Javascript development framework.</p>