Check ID:
Provider: GitHub
Service:
Severity: HIGH
Categories:
Resource type:
repository_default_branch_dismisses_stale_reviewsProvider: GitHub
Service:
repositorySeverity: HIGH
Categories:
identity-accessResource type:
NotDefinedWhat this check verifies
GitHub repository default branch ensures that when new commits are pushed to an open pull request, any previously granted approvals are automatically dismissed, requiring fresh reviews before the pull request can be merged.Risk
Without this setting, a contributor can receive approvals on a clean version of their code, then push malicious or unauthorized changes afterward. The pull request retains its approvals and can be merged without anyone reviewing the new changes, bypassing the entire code review process.Recommendation
Enable “Dismiss stale pull request approvals when new commits are pushed” in your branch protection rules. This ensures every code change undergoes a fresh review before merging.Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#dismiss-stale-pull-request-approvals-when-new-commits-are-pushed
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_default_branch_dismisses_stale_reviews. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks