Description:

This control ensures that all pull requests (PRs) must receive approval from an authorized reviewer before they can be merged into a protected branch. This review process helps validate code quality, security, and compliance with organizational standards prior to integration.


Rationale:

Requiring pull request approval before merging enforces peer review and segregation of duties, reducing the risk of introducing defects, security vulnerabilities, or unauthorized changes into critical branches. It also promotes accountability and knowledge sharing among development teams.


Impact:

  • Prevents direct merging of unreviewed code into protected branches.

  • May increase the time required to merge pull requests due to the review process.

  • Improves code quality, maintainability, and security.

  • Supports change management and compliance requirements.


Default Value:

  • Disabled by default. Repository administrators must explicitly configure a ruleset or branch protection rule to require pull request approvals before merging.


Remediation

Test Plan

  1. Sign in to GitHub with administrative access to the repository.

  2. Navigate to the target repository.

  3. Create a pull request against a protected branch.

  4. Attempt to merge the pull request without obtaining the required approval(s).

  5. Obtain the required approval(s) from an authorized reviewer.

  6. Attempt to merge the pull request again.

  7. Verify that the ruleset is active and configured to require pull request approvals before merging.

                   

  1. If the ruleset is not active or the pull request approval requirement is not configured, follow the Implementation Steps to remediate the issue and repeat the test.


Implementation Steps:

  1. Sign in to GitHub with administrative access to the repository.

  2. Navigate to the target repository.

  3. Select Settings.

  1. Under Code and automation, select Rules → Rulesets.

            

  1. Click New ruleset and select New branch ruleset, or edit an existing branch ruleset.

  1. Enter a name for the ruleset.

  2. Under Enforcement status, select Active.

  1. Under Target branches, specify the branch or branch pattern to protect (e.g., main).

        

  1. In the Rules section, enable Require a pull request before merging.

  2. Configure the Required approvals setting and specify the minimum number of approving reviews required before a pull request can be merged.

        

  1. Configure any additional review requirements as required by organizational policy.

  2. Click Create to apply the ruleset.


Backout Plan:

  1. Sign in to GitHub with administrative access to the repository.

  2. Navigate to the target repository.

  3. Select Settings.

  4. Under Code and automation, select Rules → Rulesets.

  5. Edit the applicable branch ruleset.

  6. Disable Require a pull request before merging or reduce the required approval count.

  7. Click Save changes.

  8. Verify that pull requests can be merged according to the updated configuration.


References: