Check ID: repository_default_branch_disallows_force_push
Provider: GitHub
Service: repository
Severity: HIGH
Categories: software-supply-chain
Resource type: NotDefined

​
What this check verifies

GitHub repository default branch blocks force pushes through branch protection. Evaluates whether the default branch permits force pushes.

​
Risk

Allowing force pushes on the default branch erodes integrity and auditability by enabling history rewrites and deletion of commits. Attackers or insiders can inject unreviewed code, bypass reviews and status checks, and corrupt PRs, risking supply-chain compromise and reduced availability.

​
Recommendation

Disable Allow force pushes on the default branch. Enforce PR-based changes with required reviews and status checks, require signed commits and linear history, and restrict bypass to minimal actors. Apply protections to admins too to uphold least privilege and defense in depth.

​
Remediation

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository_id       = "<example_resource_id>"
  pattern             = "<default_branch_name>"

  allows_force_pushes = false # Critical: disallows force pushes on the default branch
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = repository_default_branch_disallows_force_push. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks