Back to Checks
github

Repository default branch requires conversation resolution before merging

repository_default_branch_requires_conversation_resolution
Service: repositorySeverity: medium
OfficialBuilt-inVerified
Categories:software-supply-chain
Resource Type:NotDefined

GitHub repository default branch uses branch protection to require conversation resolution on pull requests (Require conversation resolution before merging). This protection can be enforced through classic branch protection or repository rulesets.

Prowler logoProwlerprowler-provider-github

Risk

Unresolved threads let code with known concerns reach default, weakening integrity and confidentiality. Insecure changes or secrets may ship, enabling injection, auth bypass, or data exposure. Availability can suffer from regressions; review accountability is reduced.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_default_branch_requires_conversation_resolution

Recommendation

Enable Require conversation resolution before merging on the default branch.

Also enforce:

  • Required approvals and CI checks
  • CODEOWNERS on critical paths
  • Least privilege for merge rights
  • Apply rules to admins to prevent bypass

Remediation

CLI

gh api -X PUT repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection/required_conversation_resolution -f enabled=true

Terraform

resource "github_branch_protection" "<example_resource_name>" {
  repository_id = "<example_resource_name>"
  pattern       = "<default_branch_name>"

  require_conversation_resolution = true # Critical: require all PR conversations to be resolved before merge
}

Other

1In GitHub, go to the repository > Settings
2Click Branches
3Edit the branch protection rule for the default branch (e.g., main)
4Check "Require conversation resolution before merging"
5Click Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_default_branch_requires_conversation_resolution(Check):
    """Check if a repository requires conversation resolution

    This class verifies whether each repository requires conversation resolution.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Merging Requires Conversation Resolution check

        Iterates over all repositories and checks if they require conversation resolution.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.default_branch.conversation_resolution is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                report.status = "FAIL"
                report.status_extended = f"Repository {repo.name} does not require conversation resolution on default branch ({repo.default_branch.name})."
                if (
                    repo.default_branch.conversation_resolution_source
                    == "ruleset_not_active"
                ):
                    report.status_extended = f"Repository {repo.name} has conversation resolution configured in a ruleset on default branch ({repo.default_branch.name}), but the ruleset is not active."

                if repo.default_branch.conversation_resolution:
                    report.status = "PASS"
                    report.status_extended = f"Repository {repo.name} does require conversation resolution on default branch ({repo.default_branch.name})."

                findings.append(report)

        return findings

References