Back to Checks
github

Repository default branch requires signed commits

repository_default_branch_requires_signed_commits
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:software-supply-chain
Resource Type:NotDefined

GitHub repository default branch enforces signed and verified commits (Require signed commits), allowing only commits with valid cryptographic signatures to be pushed or merged. This protection can be enforced through classic branch protection or repository rulesets.

Prowler logoProwlerprowler-provider-github

Risk

Without required signing, commit authorship can be spoofed and unverified changes added, impacting integrity.

  • Backdoor injection
  • History tampering and forged identities
  • Release pipeline abuse and supply-chain compromise

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_default_branch_requires_signed_commits

Recommendation

Enforce Require signed commits on default and release branches.

  • Standardize GPG/SSH/S/MIME for humans and bots
  • Protect and rotate signing keys; least privilege on bypass
  • Pair with required reviews and status checks for defense-in-depth

Remediation

CLI

gh api -X POST repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH_NAME>/protection/required_signatures

Terraform

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository = "<example_repository_name>"
  pattern    = "<default_branch_name>"

  required_signatures = true # Critical: Enforces signed commits on the default branch
}

Other

1In GitHub, go to the repository > Settings
2Click Branches
3Edit the rule for the default branch (or Add rule targeting the default branch name)
4Check Require signed commits
5Click Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_default_branch_requires_signed_commits(Check):
    """Check if a repository requires signed commits

    This class verifies whether each repository requires signed commits for the default branch.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Requires Signed Commits check

        Iterates over all repositories and checks if they require signed commits.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.default_branch.require_signed_commits is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                report.status = "FAIL"
                report.status_extended = f"Repository {repo.name} does not require signed commits on default branch ({repo.default_branch.name})."
                if (
                    repo.default_branch.require_signed_commits_source
                    == "ruleset_not_active"
                ):
                    report.status_extended = f"Repository {repo.name} has signed commits configured in a ruleset on default branch ({repo.default_branch.name}), but the ruleset is not active."

                if repo.default_branch.require_signed_commits:
                    report.status = "PASS"
                    report.status_extended = f"Repository {repo.name} does require signed commits on default branch ({repo.default_branch.name})."

                findings.append(report)

        return findings

References