Check ID:
Provider: GitHub
Service:
Severity: MEDIUM
Categories:
Resource type:
repository_default_branch_requires_multiple_approvalsProvider: GitHub
Service:
repositorySeverity: MEDIUM
Categories:
ci-cd, software-supply-chainResource type:
NotDefinedWhat this check verifies
GitHub repository default branch enforces required reviews with a minimum of2 approving reviews before a pull request can be merged.
Assesses whether an approval threshold of at least 2 is configured for code changes targeting the default branch.
Risk
Without multi-review approval on the default branch, a single actor can merge changes, degrading integrity and accountability. This enables:- supply-chain tampering or backdoors
- introduction of exploitable bugs
- bypass of change control via compromised accounts
Recommendation
Enforce the four-eyes principle by requiring at least2 approvals for merges to the default branch.
Strengthen with separation of duties using code owner reviews, dismiss stale approvals, apply protections to admins, and pair with required status checks for defense in depth.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/approving-a-pull-request-with-required-reviews
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_default_branch_requires_multiple_approvals. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks