Description:

This control ensures that pull requests cannot be merged into protected branches until they have received the required number of approvals from authorized reviewers. The review process helps validate code quality, security, and compliance with organizational standards before changes are integrated.


Rationale:

Requiring review approvals before merging pull requests enforces peer review and segregation of duties, reducing the risk of introducing defects, security vulnerabilities, or unauthorized changes into protected branches. It also promotes accountability, collaboration, and knowledge sharing among development teams.


Impact:

  • Prevents unreviewed code from being merged into protected branches.

  • Improves code quality, maintainability, and security.

  • Supports organizational change management and compliance requirements.

  • Promotes peer review and accountability.

  • May increase the time required to merge pull requests due to the review process.


Default Value:

Disabled by default. Repository administrators must explicitly configure pull request review requirements to require approval before merge.


Remediation

Test Plan

  1. Navigate to the target GitHub repository.

  2. Create a pull request against a protected branch.

  3. Attempt to merge the pull request without obtaining the required approval(s).

  4. Verify that the merge is blocked.

  5. Obtain the required approval(s) from an authorized reviewer.

  6. Attempt to merge the pull request again.

  7. Verify that pull request approvals are configured and enforced before merge.

  8. If pull request approvals are not configured or enforced, follow the Implementation Plan to remediate the issue and repeat the test.


Implementation Steps:

  1. Sign in to GitHub with administrative access to the repository.

  2. Navigate to the target repository.

  3. Select Settings.

  1. Under Code and automation, select Rules → Rulesets.

            

  1. Click New ruleset and select New branch ruleset, or edit an existing branch ruleset.

  1. Enter a name for the ruleset.

  2. Under Enforcement status, select Active.

  1. Under Target branches, specify the branch or branch pattern to protect (e.g., main).

        

  1. In the Rules section, enable Require a pull request before merging.

  2. Configure the Required approvals setting and specify the minimum number of approving reviews required before a pull request can be merged.

        

  1. Configure any additional review requirements as required by organizational policy.

  2. Click Create to apply the ruleset.


Backout Plan:

  1. Sign in to GitHub with administrative access to the repository.

  2. Navigate to the target repository.

  3. Select Settings.

  4. Under Code and automation, select Rules → Rulesets.

  5. Edit the applicable branch ruleset.

  6. Reduce the Required approvals value or disable Require a pull request before merging.

  7. Click Save changes.

  8. Verify that pull requests can be merged according to the updated configuration.


References: