You've seen this account. You just never looked at it.

Open any repo — yours, a library you depend on, some project you starred two years ago. Scroll the commits, or the closed pull requests, and there it is again. The same little black-and-white avatar — the GitHub Octocat itself, staring back at you.

github-actions bot committed / commented / merged…

You've seen it a thousand times. I'd seen it a thousand times. And not once had I actually clicked it.

What finally made me look wasn't curiosity. It was a copy-paste.

I was wiring up a GitHub Action that commits back to its own repo — formatting code, bumping a changelog, that kind of thing. And I didn't want those commits showing up under my name. They're automated. They should say so — anyone reading the history deserves to know a machine did it, not me. So I went looking for how to do it properly, and every thread landed on the same two lines:

git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

I pasted it in. It worked. My automated commits now showed up as the bot, Octocat avatar and all — exactly like every other robot commit I'd ever scrolled past without a second thought.

But I couldn't stop staring at that email. 41898282+github-actions[bot]@users.noreply.github.com. There's a number bolted onto the front of it. What is that? And why that one?

That number sent me down a rabbit hole that ended with me convinced this is one of the busiest accounts on the entire platform — an identity with no followers, no bio, and a name wrapped in square brackets.

This is what I found.

🔍 The first clue is a number

Every account on GitHub gets one number. Users, organizations, bots — all of them pull from a single auto-incrementing counter. So I asked the API who this thing actually is:

$ gh api "users/github-actions[bot]" --jq '{login, id, created_at, type}'
{
  "login": "github-actions[bot]",
  "id": 41898282,
  "created_at": "2018-07-30T09:30:16Z",
  "type": "Bot"
}

There's the number from the email — 41898282. So that prefix was never random: it's the account's user ID, sitting in plain sight. (Hold that thought — I'll pull the whole address apart in a second.)

And three more things made me sit up.

The type is Bot, not User. It was born on 2018-07-30 — about three months before GitHub Actions was even announced at GitHub Universe. The worker clocked in before the doors opened. And its profile link, github.com/apps/github-actions, doesn't go to a profile at all. It redirects to the product page. This account is the app.

But 41898282 meant nothing to me until I knew where counting starts. So I pulled badge number one:

$ gh api users/mojombo --jq '{login, id, created_at}'
{
  "login": "mojombo",
  "id": 1,
  "created_at": "2007-10-20T05:24:19Z"
}

That's Tom Preston-Werner. GitHub co-founder. Holder of id 1 since 2007. Everyone since is just a bigger number on the same ticket roll.

So our bot isn't special. It's just the 41,898,282nd thing GitHub ever created. And it never stopped working since.

📧 Decoding that email, piece by piece

Back to the address that started all of this. It looks like a random string GitHub bolted together, but every chunk carries meaning:

41898282 + github-actions[bot] @ users.noreply.github.com

The shape is always {id}+{login}@users.noreply.github.com — and the + is the clever bit. It's email plus-addressing (the same you+newsletter@gmail.com trick): everything between the + and the @ is a label that mail routing throws away. So all of these are, for delivery, the same address:

41898282+github-actions[bot]@users.noreply.github.com
41898282+literally-anything@users.noreply.github.com
41898282@users.noreply.github.com

Only 41898282 identifies the account. The login after the + is just decoration for whoever's reading the commit log — and that's deliberate: usernames change, IDs don't. Rename the account tomorrow and the label goes stale, but the number still points home.

And it's not a bot thing. Flip on "Keep my email address private" and GitHub hands you the exact same shape — {your-id}+{your-username}@users.noreply.github.com. The same kind of number is hiding in your own commits.

🧩 The brackets aren't a typo

I always assumed [bot] was a styling choice. It isn't. Those square brackets are how GitHub marks an App identity — and they change how you talk to it. You have to URL-encode them:

# The login literally contains [ and ]
https://api.github.com/users/github-actions%5Bbot%5D

GitHub isn't alone here. A lot of platforms decided the safest place to say this one isn't human is the name itself — so they bake bot right into it:

Same instinct every time: put the label where you can't miss it. Telegram and Wikipedia both enforce it. GitHub's twist is the brackets — it doesn't only append bot, it wraps it, making [bot] part of the actual identity. Tidy, until you have to URL-encode %5Bbot%5D at 1 a.m. But the payoff is the same: one glance at the name, and you know a machine did it.

And here's the part that explains the whole story. Every time an Action runs with the default GITHUB_TOKEN — pushing a commit, leaving a review comment, slapping a label on an issue, deploying a Pages site — the work is signed by this one identity.

Now multiply that by every repo on the planet that has CI. That's the motive. One account, an absurd amount of work, all day, in public.

🕳️ I was sure it was the first bot. I was wrong.

Here's the embarrassing part, and I'm leaving it in because it's the most useful lesson in this whole thing.

Staring at that ID, I got cocky. It has to be the first bot, right? So I scanned the ~1000 IDs sitting right before 41898282, expecting a little trail of older bots leading up to it.

I found nothing. A bunch of regular users. A lot of 404 Not Found — deleted and spam-purged accounts from that era. But not one other bot.

For about ten minutes I thought I had a scoop. Then it hit me: I wasn't investigating, I was guessing. Bots are rare and scattered across the entire ID range. Looking at 1000 numbers in a row tells you nothing. The second I checked bots I already knew, the theory fell apart:

codecov[bot] has an ID nearly 20 million lower. Our hero isn't the first bot. It's a latecomer.

Lesson, free of charge: a lower ID just means an older account. Absence in a tiny window is not evidence of anything.

🏁 Okay — so who was first?

If not this one, then who? I went looking properly this time.

The Bot type only exists because GitHub launched its Apps platform (originally "Integrations") in 2016. Anything older that automated your repo — greenkeeperio-bot, snyk-bot — was running under a plain User account, not a real bot. So nothing of type: Bot can predate mid-2016.

The earliest one I could actually verify:

$ gh api "users/waffle[bot]" --jq '{login, id, created_at, type}'
{
  "login": "waffle[bot]",
  "id": 22081289,
  "created_at": "2016-09-08T16:36:58Z",
  "type": "Bot"
}

waffle[bot] — September 2016, two years before our subject.

Am I sure it's the first? No, and I won't pretend otherwise. Proving that means scanning millions of 2016-era IDs one by one looking for type: Bot — needles in a haystack, and the rate limit says no. So the honest answer is: the first bots showed up in 2016 with GitHub Apps, and waffle[bot] is the oldest one I can put my finger on.

🤔 Wait — is there more than one of it?

One last suspicion nagged me. What if every repo or org spins up its own github-actions[bot], and I'd been chasing a whole crowd this whole time?

So I ran the lineup. A search for github-actions returns 207 accounts — and not one of them is the bot:

• github-actions-playground → Organization
• github-actions-test → Organization
• github-actions-pc-bot → a regular User
• …and ~200 more lookalikes. All User or Organization. None of them type: Bot.

There is exactly one github-actions[bot] on github.com. Our 41898282. Every repository in the world running default-token Actions writes under that same account. (The one asterisk: self-hosted GitHub Enterprise Server gets its own internal copy. On public github.com, it's a singleton.)

And that is the detail that makes the whole thing click. It isn't busy because there are millions of bots. It's busy because there's one bot doing the work of millions.

🎬 The verdict

Here's everything 41898282 taught me about how GitHub actually works under the hood:

• IDs are one dumb shared counter. mojombo is 1. Everything else is just a bigger number.
• The [bot] brackets mean App, not person — and you URL-encode them to ask about it.
• It is not the first bot. That era belongs to 2016 and accounts like waffle[bot].
• It is not a crowd. It's a single global identity.
• But it might genuinely be the hardest-working account on the platform — no followers, no bio, contributions to more repos than you or I will ever touch.

Next time that black-and-white Octocat avatar shows up in your commit log, give it a nod. 41898282 doesn't sleep, never takes a day off, and has very likely done more work today than the rest of us combined.