right but on a nostr event the pub key would have to match the signature. or the relays would reject it. So unless everyone that is able to commit to the repo shares a keypair that wont work i don't think.
I did this by having a repo publish event and then everything related to that repo has an e tag referencing the event. And at the client level you handle the collaborators, by ignoring events that arent published by pub keys with permissions.