Check ID:
Provider: GitHub
Service:
Severity: MEDIUM
Categories:
Resource type:
repository_default_branch_requires_conversation_resolutionProvider: GitHub
Service:
repositorySeverity: MEDIUM
Categories:
software-supply-chainResource type:
NotDefinedWhat this check verifies
GitHub repository default branch uses branch protection to require conversation resolution on pull requests (Require conversation resolution before merging).
Risk
Unresolved threads let code with known concerns reach default, weakening integrity and confidentiality. Insecure changes or secrets may ship, enabling injection, auth bypass, or data exposure. Availability can suffer from regressions; review accountability is reduced.Recommendation
EnableRequire conversation resolution before merging on the default branch.
Also enforce:
- Required approvals and CI checks
- CODEOWNERS on critical paths
- Least privilege for merge rights
- Apply rules to admins to prevent bypass
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_default_branch_requires_conversation_resolution. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks