Check ID:
Provider: GitHub
Service:
Severity: HIGH
Categories:
Resource type:
repository_default_branch_status_checks_requiredProvider: GitHub
Service:
repositorySeverity: HIGH
Categories:
ci-cdResource type:
NotDefinedWhat this check verifies
GitHub repository default branch uses required status checks, indicating whether merges are gated by successful check results on pull requestsRisk
Without required checks, unvetted commits can be merged, degrading code integrity and availability. Skipped or failing validations may introduce vulnerable dependencies, break builds, or allow malicious code, enabling supply-chain compromise and rapid propagation to production.Recommendation
Enforce branch protection to require status checks on the default branch.- Gate merges on build, tests, and security scans
- Use
require up-to-datebehavior to reduce integration risk - Apply to admins and limit bypasses
- Combine with least privilege and required reviews for defense in depth
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
- https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging
- https://docs.gearset.com/en/articles/2437757-managing-status-check-rules-in-github
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_default_branch_status_checks_required. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks