Repository enforces branch protection on the default branch

​

What this check verifies

​

Risk

• Unauthorized direct pushes/force pushes
• Malicious code injection and workflow tampering
• Accidental deletions or unstable releases This undermines code integrity and service availability.

​

Recommendation

• Require pull requests with approvals (least privilege)
• Enforce required status checks and conversation resolution
• Require signed commits and linear history; block force pushes/deletions
• Restrict push to trusted actors and apply rules to admins Use CODEOWNERS to strengthen review accountability.

​

Remediation

gh api -X PUT repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection -f required_status_checks='null' -f required_pull_request_reviews='null' -f enforce_admins=false -f restrictions='null'

# Enable branch protection on the default branch
# Minimal: create a protection rule targeting the default branch

data "github_repository" "repo" {
  full_name = "<OWNER>/<REPO>"
}

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository_id = data.github_repository.repo.node_id
  pattern       = "<DEFAULT_BRANCH>"  # Critical: protects the default branch so the check passes
}

​

References

• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches

​

Where this check fires