Check ID:
Provider: GitHub
Service:
Severity: LOW
Categories:
Resource type:
repository_default_branch_requires_linear_historyProvider: GitHub
Service:
repositorySeverity: LOW
Categories:
software-supply-chainResource type:
NotDefinedWhat this check verifies
GitHub repository default branch enforcesRequire linear history, blocking merge commits and allowing only squash or rebase merges
Risk
Without a linear history, commit provenance is harder to verify, weakening integrity and accountability. Merge commits can obscure diffs entering the default branch, hindering audits and rollbacks, enabling unnoticed malicious or unreviewed code, and delaying incident response.Recommendation
EnableRequire linear history on the default branch and allow only squash or rebase merges.
Reinforce with branch protection: require pull requests and reviews, status checks, and signed commits. Limit bypass to trusted roles (least privilege) to preserve traceability and defense in depth.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-linear-history
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_default_branch_requires_linear_history. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks