# Changes require a pull request before merge

- Source: https://support.icompaas.com/support/solutions/articles/a_1781201674516148-changes-require-a-pull-request-before-merge
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Version Control System (VCS)](https://support.icompaas.com/support/solutions/c_1781179095087930) › [GitHub](https://support.icompaas.com/support/solutions/folders/f_1781179116560328)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This control ensures that changes cannot be merged directly into protected branches and must be submitted through a pull request before being merged. Requiring pull requests provides a structured review process for evaluating proposed changes before they are incorporated into the codebase.

  

Rationale:

Requiring pull requests before merging helps enforce change management processes, promotes peer review, and reduces the risk of unauthorized or unreviewed changes being introduced into protected branches. This control improves code quality, accountability, and traceability of changes.

  

Impact:

-   Prevents direct commits and merges to protected branches.
    
-   Ensures code changes are reviewed through the pull request process.
    
-   Improves change tracking and auditability.
    
-   Supports organizational security and compliance requirements.
    
-   May increase the time required to merge changes due to the review workflow.
    

  

Default Value:

Disabled by default. Repository administrators must explicitly configure rulesets to require pull requests before changes can be merged.

  

Remediation

Test Plan

1.  Navigate to the target GitHub repository.
    
2.  Verify that a ruleset is configured for the protected branch.
    
3.  Attempt to push or merge changes directly into the protected branch without creating a pull request.
    
4.  Verify that the direct update is blocked.
    
5.  Create a pull request targeting the protected branch.
    
6.  Verify that changes can be merged only through the pull request process.
    
7.  If changes can be merged without a pull request, follow the Implementation Plan to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to GitHub with administrative access to the repository.
    
2.  Navigate to the target repository.
    
3.  Select Settings.
    

4.  Under Code and automation, select Rules → Rulesets.
    

5.  Create a new branch ruleset or edit an existing branch ruleset.
    

6.  Enter a name for the ruleset.
    
7.  Under Enforcement status, select Active.
    

8.  Under Target branches, specify the branch or branch pattern to protect (e.g., main).
    

9.  Enable Require a pull request before merging.
    
10.  Configure any additional pull request requirements according to organizational policy.
     

11.  Click Create to apply the ruleset.
     

  

Backout Plan:

1.  Sign in to GitHub with administrative access to the repository.
    
2.  Navigate to the target repository.
    
3.  Select Settings.
    
4.  Under Code and automation, select Rules → Rulesets.
    
5.  Edit the applicable branch ruleset.
    
6.  Disable Require a pull request before merging.
    
7.  Click Save changes.
    

  

References:

-   [GitHub Rulesets Documentation](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets)
    
-   [GitHub Protected Branches Documentation](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/about-protected-branches)
    
-   [GitHub Pull Requests Documentation](https://docs.github.com/en/pull-requests)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.