Check ID:
Provider: GitHub
Service:
Severity: HIGH
Categories:
Resource type:
repository_default_branch_requires_codeowners_reviewProvider: GitHub
Service:
repositorySeverity: HIGH
Categories:
software-supply-chainResource type:
NotDefinedWhat this check verifies
GitHub repository default branch requires Code Owners approval for pull requests that modify paths declared inCODEOWNERS
Risk
Without required Code Owners review, non-owners can merge changes to sensitive code, undermining integrity. This increases the chance of malicious code injection, hidden backdoors, or fragile changes that enable data exfiltration or cause outages, impacting confidentiality and availability.Recommendation
Enforce Code Owners review on the default branch and keepCODEOWNERS accurate and team-based.
Apply least privilege, require status checks and signed commits, extend protections to admins, and audit ownership regularly. Co-own critical paths to ensure coverage and reduce single-point approval gaps.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-review-from-code-owners
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_default_branch_requires_codeowners_review. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks