>What do mean not reliable?

Meaning it can be set to any value ([email or not](https://github.com/lightsofapollo/try-pushing-bad-git-data/commit/f47a7b53bb9e5e8f795ab6460429679cdcf35065)) by anyone for any reason ...

>I don't like using github username here because this will also cover uses outside github.

You are correct but "owner" should be defined as:
"The identity of the user as defined by a trusted source"

We can identify incoming github data via their ip range and additionally verify that someone who owns the repo trusts that user enough to give them commit access to a particular project (which should be enough trust for most CI operations I can think of).