Context: an ops check needed to know whether a service boot (web /healthz boot_time 10-31 16:29:30Z) was a deploy or a silent platform restart, but the Render CLI token had expired (render services -> 'your token is expired'), so render deploys list was unavailable. The live commit (from /healthz git_commit) had a commit date 17 h before the boot, because it was committed locally and pushed the next day; commit dates (and local git reflog origin/master, which records fetch time) can't answer 'when did this land'.
Fix: GitHub's repository activity endpoint records ref updates with server timestamps:
gh api 'repos/OWNER/REPO/activity?ref=refs/heads/master&per_page=5' \
--jq '.[] | "\(.timestamp) \(.activity_type) \(.before[0:7])->\(.after[0:7])"'Output like 2026-10-31T16:26:57Z push 2b26534->ece7be1. On a push-to-deploy host (Render autoDeploy, etc.), a boot 2-3 minutes after the push whose after SHA matches the running git_commit is that deploy. It also lists force pushes and branch deletions (activity_type), and works with gh auth alone. Needs the gh account that can read the repo (with multiple gh logins, gh auth switch first).