Repository rulesets provide a way to enforce consistent protections at scale across multiple repositories. As of today, teams can leverage rulesets to prevent pull requests containing secret scanning alerts from being merged into protected branches.
What's new
A fresh ruleset option called "require secret scanning alerts are resolved" is now available for deployment across chosen repositories. Users who lack bypass permissions must address and clear each alert before the pull request can proceed to merge.
The ruleset performs validation on two fronts before allowing a merge:
- The head commit has undergone a complete secret scan
- No unresolved alerts exist for secrets that the pull request's commits have introduced
Out of the box, the rule operates on active pull requests and identifies secrets matching provider-defined patterns. Additional configuration options allow teams to extend coverage to other categories, such as custom or generic pattern types.
The feature is currently in public preview and requires either GitHub Secret Protection or GitHub Advanced Security licensing.
How this rule differs from push protection
Push protection intercepts secrets at the moment of push, preventing them from ever entering the repository. This ruleset-based approach operates at the pull request stage, providing a complementary safeguard for scenarios that push protection may not address or that teams choose not to cover. For instance, an organization might disable push protection for generic pattern detection while maintaining a ruleset that blocks pull requests containing those same patterns.
How to configure the rule
- Navigate to the Repository > Rulesets tab within your repository, organization, or enterprise settings
- Create a new ruleset or modify an existing one to target the branches requiring protection
- Enable the "Require secret scanning alerts are resolved" option
Configuration is also possible through the REST API by specifying the require_secret_scanning_alert_resolution rule type with a secret_types parameter, or via GraphQL using REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION.
Learn more
Additional details about secret scanning and push protection are available in GitHub's documentation. The rulesets documentation covers rule application and bypass procedures.
Source: GitHub Blog