Back to Checks
github

Repository deletes branches after pull request merge

repository_branch_delete_on_merge_enabled
Service: repositorySeverity: low
OfficialBuilt-inVerified
Categories:software-supply-chain
Resource Type:NotDefined

GitHub repository setting that enables automatic deletion of head branches when pull requests merge into the default branch (delete_branch_on_merge).

Prowler logoProwlerprowler-provider-github

Risk

Without automatic deletion, merged branches persist, weakening integrity and confidentiality: outdated code may be reused, secret remnants can linger, and reviews become ambiguous. Stale refs can still trigger CI with obsolete workflows, raising risks of supply-chain tampering and faulty deployments.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_branch_delete_on_merge_enabled

Recommendation

Enable automatic head-branch deletion after merges to minimize stale refs and confusion.

  • Enforce least privilege for branch creation
  • Apply branch protection and rulesets
  • Prefer short-lived feature branches with periodic pruning
  • Guard CI to avoid runs from obsolete branches

Remediation

CLI

gh api -X PATCH repos/<OWNER>/<REPO> -f delete_branch_on_merge=true

Terraform

resource "github_repository" "<example_resource_name>" {
  name                   = "<example_resource_name>"
  delete_branch_on_merge = true  # Enables automatic deletion of PR head branches after merge
}

Other

1In GitHub, open the repository and click Settings
2Under General, scroll to Pull Requests
3Check Automatically delete head branches
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_branch_delete_on_merge_enabled(Check):
    """Check if a repository deletes branches on merge

    This class verifies whether each repository deletes branches on merge.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Deletes Branch On Merge check

        Iterates over all repositories and checks if they delete branches on merge.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            report = CheckReportGithub(metadata=self.metadata(), resource=repo)
            report.status = "FAIL"
            report.status_extended = f"Repository {repo.name} does not delete branches on merge in default branch ({repo.default_branch.name})."

            if repo.delete_branch_on_merge is None:
                report.status = "MANUAL"
                report.status_extended = f"Repository {repo.name} branch deletion setting could not be checked in default branch ({repo.default_branch.name}) due to insufficient permissions. Requires Administration: Read and Write permission."
            elif repo.delete_branch_on_merge:
                report.status = "PASS"
                report.status_extended = f"Repository {repo.name} does delete branches on merge in default branch ({repo.default_branch.name})."

            findings.append(report)

        return findings

References