Repository default branch requires signed commits

​

What this check verifies

​

Risk

• Backdoor injection
• History tampering and forged identities
• Release pipeline abuse and supply-chain compromise

​

Recommendation

• Standardize GPG/SSH/S/MIME for humans and bots
• Protect and rotate signing keys; least privilege on bypass
• Pair with required reviews and status checks for defense-in-depth

​

Remediation

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository = "<example_repository_name>"
  pattern    = "<default_branch_name>"

  required_signatures = true # Critical: Enforces signed commits on the default branch
}

​

References

• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-signed-commits
• https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification

​

Where this check fires