Description:

This check verifies that changes to the default branch can only be introduced through Merge Requests (MRs) and that direct pushes to the protected branch are restricted. This ensures that all code changes follow the organization's review and approval process before being merged.


Rationale:

Allowing direct pushes to critical branches can bypass code review, testing, and approval processes. Requiring Merge Requests before changes are merged improves code quality, strengthens change management controls, and reduces the risk of unauthorized or unreviewed changes reaching production.


Impact:

Enforcing Merge Request requirements may:

  • Prevent users from pushing changes directly to the default branch.

  • Require all changes to be submitted through Merge Requests.

  • Increase review and approval activities.

  • Improve code quality, traceability, and governance.


Default Value:

Depends on project configuration.

In GitLab, external collaborator push access is controlled through:

  • Project membership roles.

  • Protected Branch settings.

  • Group-level permissions.

By default, users with sufficient project permissions may be able to push unless branch protections are configured.


Remediation:

Test Plan:

  1. Log in to GitLab with Maintainer or Owner privileges.

  2. Navigate to the project.

  3. Select Settings → Repository.

  4. Locate the Protected Branches section.

  5. Identify the default branch (for example, main).

  6. Verify the following:

    • The branch is protected.

    • Allowed to push and merge is set to No one or Maintainers only.

    • Developers, Guests, and external users are not allowed to push directly.

  7. Navigate to Manage → Members.

  8. Review project members and their assigned roles.

  9. Verify that external collaborators do not have Maintainer or Owner privileges.


Implementation:

  1. Log in to GitLab with Maintainer or Owner privileges.

  2. Navigate to the project.

  3. Select Settings → Repository.

  4. Expand the Protected Branches section.

  1. Configure the default branch:

    • Allowed to push and merge: No one (recommended).

    • Allowed to merge: Maintainers.

  1. Save the configuration.

  2. Navigate to Manage → Members.

  3. Review external users and contractors.

  4. Assign the minimum required role (Guest, Reporter, or Developer as appropriate).

  5. Ensure external collaborators are not assigned Maintainer or Owner roles.


Backout Plan:

  1. Log in to GitLab with Maintainer or Owner privileges.

  2. Navigate to Settings → Repository.

  3. Expand the Protected Branches section.

  4. Modify the push permissions to their previous values.

  5. Navigate to Manage → Members.

  6. Restore previous user roles if approved.

  7. Save the changes.


References: