Back to Checks
github

Repository denies default branch deletion

repository_default_branch_deletion_disabled
Service: repositorySeverity: medium
OfficialBuilt-inVerified
Categories:software-supply-chain
Resource Type:NotDefined

GitHub repository default branch have branch protections or rulesets with Allow deletions disabled.

Prowler logoProwlerprowler-provider-github

Risk

Permitting default branch deletion undermines availability by breaking CI/CD, releases, and PR targets.

It also impacts integrity: the canonical ref can be removed, enabling history tampering, branch hijacking, and harder audits/rollbacks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_default_branch_deletion_disabled

Recommendation

Disable deletions on the default branch using branch protection or rulesets (Allow deletions=false). Apply controls to admins, minimize bypass lists, and enforce least privilege. Combine with required pull requests and status checks for defense in depth.

Remediation

CLI

gh api -X DELETE repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection/allow_deletions

Terraform

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository_id    = "<example_resource_name>"
  pattern          = "<default_branch>"
  allows_deletions = false  # Critical: disables deletion of the default branch
}

Other

1In GitHub, open the repository and go to Settings > Branches
2Edit the branch protection rule for the default branch (or Add rule if none exists)
3Ensure "Allow deletions" is unchecked
4Click Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_default_branch_deletion_disabled(Check):
    """Check if a repository denies branch deletion

    This class verifies whether each repository denies default branch deletion.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Denies Default Branch Deletion check

        Iterates over all repositories and checks if they deny default branch deletion.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.default_branch.branch_deletion is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                report.status = "FAIL"
                report.status_extended = (
                    f"Repository {repo.name} does allow default branch deletion."
                )
                if repo.default_branch.branch_deletion_source == "ruleset_not_active":
                    report.status_extended = f"Repository {repo.name} has default branch deletion disabled in a ruleset, but the ruleset is not active."

                if not repo.default_branch.branch_deletion:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Repository {repo.name} does deny default branch deletion."
                    )

                findings.append(report)

        return findings

References