Check ID:
Provider: GitHub
Service:
Severity: LOW
Categories:
Resource type:
repository_branch_delete_on_merge_enabledProvider: GitHub
Service:
repositorySeverity: LOW
Categories:
software-supply-chainResource type:
NotDefinedWhat this check verifies
GitHub repository setting that enables automatic deletion of head branches when pull requests merge into the default branch (delete_branch_on_merge).
Risk
Without automatic deletion, merged branches persist, weakening integrity and confidentiality: outdated code may be reused, secret remnants can linger, and reviews become ambiguous. Stale refs can still trigger CI with obsolete workflows, raising risks of supply-chain tampering and faulty deployments.Recommendation
Enable automatic head-branch deletion after merges to minimize stale refs and confusion.- Enforce least privilege for branch creation
- Apply branch protection and rulesets
- Prefer short-lived feature branches with periodic pruning
- Guard CI to avoid runs from obsolete branches
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_branch_delete_on_merge_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks