Back to Checks
github

Repository default branch dismisses stale pull request approvals

repository_default_branch_dismisses_stale_reviews
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

GitHub repository default branch ensures that when new commits are pushed to an open pull request, any previously granted approvals are automatically dismissed, requiring fresh reviews before the pull request can be merged.

Prowler logoProwlerprowler-provider-github

Risk

Without this setting, a contributor can receive approvals on a clean version of their code, then push malicious or unauthorized changes afterward. The pull request retains its approvals and can be merged without anyone reviewing the new changes, bypassing the entire code review process.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_default_branch_dismisses_stale_reviews

Recommendation

Enable "Dismiss stale pull request approvals when new commits are pushed" in your branch protection rules. This ensures every code change undergoes a fresh review before merging.

Remediation

CLI

gh api -X PATCH /repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection/required_pull_request_reviews -f dismiss_stale_reviews=true

Terraform

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository = "<example_resource_name>"
  branch     = "<DEFAULT_BRANCH>"

  required_pull_request_reviews {
    dismiss_stale_reviews = true
  }
}

Other

1Using Rulesets (recommended): 1. Go to repository Settings > Rules > Rulesets. 2. Click 'New ruleset' > 'New branch ruleset' (or edit an existing one targeting the default branch). 3. Under 'Require a pull request before merging', enable 'Dismiss stale pull request approvals when new commits are pushed'. 4. Click 'Create' or 'Save changes'. Using classic branch protection: 1. Go to repository Settings > Branches. 2. Edit or add a branch protection rule for the default branch. 3. Under 'Require a pull request before merging', enable 'Dismiss stale pull request approvals when new commits are pushed'. 4. Click 'Save changes'.

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_default_branch_dismisses_stale_reviews(Check):
    """Check if a repository dismisses stale pull request approvals when new commits are pushed.

    This class verifies whether each repository is configured to automatically
    invalidate existing approvals when new commits are pushed to an open pull request.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the check.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository.
        """
        findings = []

        for repo in repository_client.repositories.values():

            if repo.default_branch.dismiss_stale_reviews is not None:

                report = CheckReportGithub(metadata=self.metadata(), resource=repo)

                report.status = "FAIL"
                report.status_extended = f"Repository {repo.name} does not dismiss stale pull request approvals when new commits are pushed."
                if (
                    repo.default_branch.dismiss_stale_reviews_source
                    == "ruleset_not_active"
                ):
                    report.status_extended = f"Repository {repo.name} has dismiss stale pull request approvals configured in a ruleset, but the ruleset is not active."

                if repo.default_branch.dismiss_stale_reviews:
                    report.status = "PASS"
                    report.status_extended = f"Repository {repo.name} does dismiss stale pull request approvals when new commits are pushed."

                findings.append(report)

        return findings

References