Back to Checks
github

Repository default branch requires code owner approval for changes to owned code

repository_default_branch_requires_codeowners_review
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:software-supply-chain
Resource Type:NotDefined

GitHub repository default branch requires Code Owners approval for pull requests that modify paths declared in CODEOWNERS. This protection can be enforced through classic branch protection or repository rulesets.

Prowler logoProwlerprowler-provider-github

Risk

Without required Code Owners review, non-owners can merge changes to sensitive code, undermining integrity. This increases the chance of malicious code injection, hidden backdoors, or fragile changes that enable data exfiltration or cause outages, impacting confidentiality and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_default_branch_requires_codeowners_review

Recommendation

Enforce Code Owners review on the default branch and keep CODEOWNERS accurate and team-based. Apply least privilege, require status checks and signed commits, extend protections to admins, and audit ownership regularly. Co-own critical paths to ensure coverage and reduce single-point approval gaps.

Remediation

CLI

gh api -X PATCH repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection/required_pull_request_reviews -f require_code_owner_reviews=true

Terraform

resource "github_branch_protection" "<example_resource_name>" {
  repository_id = "<example_resource_id>"
  pattern       = "<DEFAULT_BRANCH>"

  required_pull_request_reviews {
    require_code_owner_reviews = true  # Critical: enforces CODEOWNERS approval on the default branch
  }
}

Other

1In GitHub, open the repository and go to Settings > Branches
2Edit the branch protection rule for <DEFAULT_BRANCH> (or click Add rule)
3Set Branch name pattern to <DEFAULT_BRANCH>
4Check Require a pull request before merging
5Under Pull request reviews, check Require review from Code Owners
6Click Create/Save to apply

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_default_branch_requires_codeowners_review(Check):
    """Check if code owner approval is required for changes to owned code

    This class verifies whether each repository requires code owner review for changes to code they own.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Code Owner Approval Requirement check

        Iterates over all repositories and checks if they require code owner review for changes.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.default_branch.require_code_owner_reviews is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                if repo.default_branch.require_code_owner_reviews:
                    report.status = "PASS"
                    report.status_extended = f"Repository {repo.name} requires code owner approval for changes to owned code."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Repository {repo.name} does not require code owner approval for changes to owned code."
                    if (
                        repo.default_branch.require_code_owner_reviews_source
                        == "ruleset_not_active"
                    ):
                        report.status_extended = f"Repository {repo.name} has code owner approval configured in a ruleset, but the ruleset is not active."

                findings.append(report)

        return findings

References