Description:
This control ensures that pull requests cannot be merged until they have received the required number of approvals from authorized reviewers. The review process helps validate code quality, security, and compliance with organizational standards before changes are integrated into protected branches.
Rationale:
Requiring review approvals before merging pull requests enforces peer review and segregation of duties, reducing the risk of introducing defects, security vulnerabilities, or unauthorized changes into critical code repositories. It also promotes accountability, collaboration, and knowledge sharing among development teams.
Impact:
Prevents unreviewed code from being merged into protected branches.
May increase the time required to complete pull request reviews and merges.
Improves code quality, maintainability, and security.
Supports organizational change management and compliance requirements.
Default Value:
Disabled by default. Repository administrators must explicitly configure branch restrictions to require pull request approvals before merging.
Remediation
Test Plan:
Navigate to the target Bitbucket repository.
Create a pull request against a branch protected by the branch restriction.
Attempt to merge the pull request without obtaining the required approval(s).
Obtain the required approval(s) from an authorized reviewer.
Attempt to merge the pull request again.
Verify that the Minimum number of approvals merge check is configured and enforced.
If the approval requirement is not configured or enforced, follow the Implementation Steps to remediate the issue and repeat the test.
Implementation Steps:
Sign in to Bitbucket with administrative access to the repository.
Navigate to the target repository.
Click the three-dot menu (⋯) next to the repository name and select Settings.
Under Workflow, select Branch restrictions.
Click Add a branch restriction or edit an existing branch restriction.
Under Select branches, specify the branch name, branch pattern, or branch type to protect.
Select the Merge settings tab.
Under Merge checks, enable Minimum number of approvals.
Specify the minimum number of required approvals according to organizational policy.
Click Save to apply the branch restriction.
Backout Plan:
Sign in to Bitbucket with administrative access to the repository.
Navigate to the target repository.
Click the three-dot menu (⋯) next to the repository name and select Settings.
Under Workflow, select Branch restrictions.
Edit the applicable branch restriction.
Select the Merge settings tab.
Disable the minimum number of approvals or reduce the required approval count.
Click Save to apply the updated configuration.
References: