This article explains where to look, during a security check or after something goes wrong, for who added a member, who changed branch protection, and who merged code. After reading it, you can open Activities in the sidebar, filter by activity type, and read who did what, and when. The merge method and the code author are in Git history. Actions that are missing from Activity have to be looked up in database backups and server logs.
1. Where to look for the questions people usually ask
Records in Activity are grouped by activity type. The names in the Activity Type menu are Commit, Pull Request, Merge, Team, Config, and Branch. The stats card at the top of the page labels the push category Commits, which is the same category as Commit in the menu. The table below says which menu label to pick, and the English text of a newly saved record. A record keeps the language the console was using when it was saved. The example later in this article was saved in Chinese, so the picture still shows that Chinese sentence.
| Question | Activity type in the menu | What the record says |
|---|---|---|
| Who added someone to a team | Team |
Added team member. If the invitation has not been accepted yet: Invited member name
|
| Who added someone to a repository | Team |
Added collaborator username, for example Added collaborator xlliu
|
| Who changed a permission or a role | Team | Repository collaborator: Updated collaborator username permission. Team: Updated team member role
|
| Who removed a member or a collaborator | Team |
Removed team member, Removed member, Removed collaborator username
|
| Who changed or deleted branch protection | Config |
Set branch protection or Deleted branch protection, with the branch name stuck on the end and no space |
| Who changed repository settings or visibility | Config |
Updated repository settings, Updated repository visibility
|
| Who added, changed, or deleted a Webhook | Config |
Created Webhook, Updated Webhook, Deleted Webhook
|
| Who merged a pull request | Pull Request (the pull request page can also be checked) | Merged Pull Request #number |
| Who pushed code to a repository | Commit | One commit is Pushed commit to. Several commits are Pushed N commits to
|
| Who deleted a branch | Branch |
Deleted branch, then a space and the branch name |
| Where someone signed in recently | Not in Activity | AngusGM Organization → Users, open the user, then Login History (the last 10 sign-ins) |
A few points while you read that table:
-
Merge in the menu records only a direct merge of one branch into another. The text is
Merged branch A into B. The example instance currently has 0 of these. A merge that went through a pull request is under Pull Request. - There is no space between the branch-protection text and the branch name. One record that already exists was saved in Chinese as
mcp-round1-locked. The English wording of that same action isSet branch protectionmcp-round1-locked. Saving a branch-protection rule stores the sentence in the console language used at that moment. The other sentences in the table follow the tenant's default language. - Some push records have no user name. The page shows Unknown User.
- Some texts exist in the system and have not appeared on the example instance: among 26 team records there is no invitation and no removal, and among 70 configuration records there is no deleted branch protection and no Webhook record. Under the branch type, what you see now is
Created branchfollowed by a space and the branch name.
2. Look up one record in Activity
- Open Activity
In the sidebar, open Activities. The page title is Activity. It says "Review commits, reviews, issues, pipelines, and other actions." The list is newest first.
- Narrow it with the filters
Use the filters at the top. Activity Type is the matching row from the table above. Repository is the repository you want to check. The menu lists 20 names at a time. If the repository you want is not there, search for the repository name inside the menu, then select it. User is the person you suspect. Leave it empty if you are not sure. Time Range can be This week, This month, This quarter, This year, or All time. You can also type a keyword from the user, the repository, the branch, or the description into the search box. The placeholder is "Search users, repositories, branches or details...".
- Read the record
Configuration, team, and pull request records say who, which repository, what they did, and when. To look up branch protection: set the activity type to Config, type 分支保护 in the search box for this example (the saved sentence is Chinese; an English record matches branch protection), set the time range to This month, and the result is the picture below.
The record in the picture means: Angus set protection on branch mcp-round1-locked in repository e2e-git01-defaults. The record body is mcp-round1-locked. The link text after it is branch_protection. The status is Success. The time is shown as 4 days ago, which is 2026-10-22 16:36:09. If someone deletes branch protection, the text is Deleted branch protection with the branch name stuck on the end. Under this filter, this month has no delete record.
3. What Git history can add
Activity tells you who merged the pull request. It does not say which merge method was used. The code itself can answer that. Every commit in Git history records an author (the person who wrote the code) and a committer (the person who wrote that commit into the repository). Each merge method leaves a different trace in the history of main:
| Merge method | How the commit count changes | What you see in the history of main
|
|---|---|---|
| Merge commit | One new commit with two parents (except a fast-forward) | The message is Merge pull request #N from …
|
| Squash merge | Several commits pressed into one ordinary commit | The author is the pull request author. The committer is the person who clicked merge |
| Rebase merge | Replayed one by one | Each commit is applied again onto main, and the commit hash differs from the original |
A "commit with two parents" in that table is a merge commit that joins main and the source branch. A fast-forward is the exception: when a fast-forward is possible, Git places the source branch's commits onto the end of main and does not add that merge commit. "Replayed one by one" means each commit from the source branch is applied again onto main, so the commit hashes change.
To see who wrote the code in a file, and which pull request it came in through, run:
git log --format='%h %an %cn %cd %s' --date=iso -- path/to/file
In the output, %an is the author, %cn is the committer, and %cd is the commit time. If the merge was a squash merge, the author is the person who wrote the code and the committer is the person who clicked merge. The commit message usually includes the pull request title. Take that title back to AngusGit, find the pull request, and read the review record.
The pull request page is a record of its own: who opened it, who reviewed it, what the review decision was, and what was discussed are all kept on that pull request.
4. What is not recorded today
Activity does not contain the cases below. Before a security check, know that, and prepare a substitute.
| Case | What exists today | What to do |
|---|---|---|
| Which branch-protection item changed | It records only Set branch protection. It does not record the rules before and after |
Put branch-protection changes through an internal approval ticket, and write down what changed |
| Source IP of an action | Activity records have no IP | Sign-ins are in AngusGM, on the user, under Login History. Other access is in the proxy logs (after this table) |
| Force push | Recorded like an ordinary push, as Pushed commit to or Pushed N commits to, with no separate mark |
In branch protection, leave Allow force pushes off, so it is blocked at the source |
| A push that was refused | A push refused by branch protection does not enter Activity. It is only in the AngusGit server log | Keep the server log when you need it |
| Export | Activity cannot be exported | Back up the AngusGit database on a schedule |
| How long records are kept | Activity has no automatic cleanup setting | Back up on the schedule your company requires. When cleanup is needed, operations follows the backup policy |
| Who merged, and when, shown on the page | The pull request page does not show the person who merged or the merge time | Read Merged Pull Request #number under the Pull Request type in Activity, or read Git history |
About source IP: sign-in sources are on the user in AngusGM, under Login History, which lists the last 10 login records. For a finer access source, keep the access log of the reverse proxy or the load balancer. The committer and the commit time in Git history can also support who merged and when.
One place is easy to mix up. AngusGM Management → Logs also has Audit Logs ("View and manage user operations and system logs"). That log records user operations and system logs of the AngusGM platform itself. It does not include operations inside a Git repository. For a Git question, look at Activity in AngusGit.
5. Do these things before you need them
The hard case after an incident is a record that was never written. Do the following when the repository goes live:
- In branch protection, turn on Include administrators, and leave Allow force pushes and Allow deletions off. History then cannot be rewritten, the main branch cannot be deleted, and an administrator cannot skip the review.
- Grant permission to a team when you can, and use fewer individual collaborators. Joining and leaving a team are both recorded under Team, which is clearer than opening every repository and checking its collaborators one by one.
- Back up the database on a schedule, and keep the server logs. Activity lives in the database and cannot be exported. A refused push appears only in the server log.
- Put important settings changes through an approval ticket. Activity records only who changed something, and when. The ticket can add why it changed, and what it changed to.
Frequently asked questions
If AngusGit is installed, does that meet the code-repository requirements of 等保?
You cannot say that. 等保 is China's classified protection of cybersecurity. Activity in AngusGit can supply only some of the operation records. 等保 also covers identity checks, access control, how long logs are kept, backup and restore, and more. That has to be judged against your overall plan and the requirements of the assessment organization. The gaps listed in section 4 are the parts to fill in when you prepare the materials.
A pull request was merged and then reverted. Can that be found?
Yes. The revert itself is a new commit or a new pull request, so it shows up in Activity as a push or a merge. Git history also shows that Revert … commit.
Summary
To look up an operation record on Git, start with Activities in AngusGit. The page title is Activity. Members and permissions are under Team. Branch protection, repository settings, visibility, and Webhooks are under Config. A pull request merge is under Pull Request. A push is under Commit. Merge in the filter records only a direct merge of one branch into another, and the example currently has none of those. The merge method, the author, and the committer are in Git history. The review decision is on the pull request page. Activity does not record the rules before and after a change, does not record an IP, and cannot be exported. A refused push is not in it either. Fill those gaps with a change-approval ticket, a database backup, server logs, and reverse-proxy logs. Sign-in records are in AngusGM under Organization → Users, on the user, in Login History.
Conclusion: Member changes are under Team, branch protection is under Config, and a pull request merge is under Pull Request. The exact rules before and after a change, the source IP, and a refused push have to be kept separately in an approval ticket, reverse-proxy logs, and server logs.
Top comments (0)