Back to Checks
github

Repository default branch requires status checks

repository_default_branch_status_checks_required
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:ci-cd
Resource Type:NotDefined

GitHub repository default branch uses required status checks, indicating whether merges are gated by successful check results on pull requests. This protection can be enforced through classic branch protection or repository rulesets.

Prowler logoProwlerprowler-provider-github

Risk

Without required checks, unvetted commits can be merged, degrading code integrity and availability. Skipped or failing validations may introduce vulnerable dependencies, break builds, or allow malicious code, enabling supply-chain compromise and rapid propagation to production.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_default_branch_status_checks_required

Recommendation

Enforce branch protection to require status checks on the default branch.

  • Gate merges on build, tests, and security scans
  • Use require up-to-date behavior to reduce integration risk
  • Apply to admins and limit bypasses
  • Combine with least privilege and required reviews for defense in depth

Remediation

CLI

gh api -X PATCH repos/<OWNER>/<REPO>/branches/<DEFAULT_BRANCH>/protection/required_status_checks -f strict=false -F contexts[]=<CHECK_NAME>

Terraform

resource "github_branch_protection_v3" "<example_resource_name>" {
  repository_id = "<example_repository_id>"
  pattern       = "<DEFAULT_BRANCH>"

  required_status_checks {
    strict   = false
    contexts = ["<CHECK_NAME>"] # Critical: requires this status check to pass before merging
  }
}

Other

1In GitHub, go to the repository > Settings > Branches
2Next to Branch protection rules, click Add rule (or Edit for the default branch rule)
3Set Branch name pattern to your default branch (e.g., main)
4Check Require status checks to pass before merging
5In the list, select at least one check (e.g., your CI workflow)
6Click Create (or Save changes)

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_default_branch_status_checks_required(Check):
    """Check if a repository enforces status checks.

    This class verifies whether each repository enforces status checks.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository

        Iterates over all repositories and checks if they enforce status checks.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository.
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.default_branch.status_checks is not None:
                report = CheckReportGithub(self.metadata(), resource=repo)
                report.status = "FAIL"
                report.status_extended = (
                    f"Repository {repo.name} does not enforce status checks."
                )
                if repo.default_branch.status_checks_source == "ruleset_not_active":
                    report.status_extended = f"Repository {repo.name} has status checks configured in a ruleset, but the ruleset is not active."

                if repo.default_branch.status_checks:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Repository {repo.name} does enforce status checks."
                    )

                findings.append(report)

        return findings

References