Description:

This check verifies that Bitbucket is configured to require changes to be submitted through a Pull Request before they can be merged into protected branches. This control prevents users from bypassing the review process by directly merging changes into critical branches.


Rationale:

Requiring Pull Requests ensures that code changes undergo review, discussion, and validation before being merged. This helps improve code quality, supports change management processes, and reduces the risk of introducing unauthorized or untested code into production branches.


Impact:

Enforcing Pull Request requirements may:

  • Prevent direct code integration into protected branches.

  • Require developers to create Pull Requests for all changes.

  • Increase review and approval activities.

  • Improve code quality, accountability, and governance.


Default Value:

Disabled

By default, Bitbucket does not require Pull Requests before changes can be merged. Repository administrators must configure branch restrictions and merge checks to enforce Pull Request-based workflows.


Remediation:

Test Plan:

  1. Log in to Bitbucket with access to the repository.

  2. Navigate to Repository Settings.

  3. Select Branch Restrictions.

  4. Review the restrictions configured for the default branch.

  5. Verify that direct pushes are restricted.

  6. Verify that changes must be submitted through Pull Requests before they can be merged.

  7. Create a test change and attempt to push directly to the protected branch.


Implementation:

  1. Log in to Bitbucket with repository administrator privileges.

  2. Navigate to the target repository.

  3. Select Repository Settings.

  4. Click Branch Restrictions.

  5. Click Add a Branch Restriction.

  6. In the select  branch section add * in By branch name or pattern (it will select all branches)

  7. In the write access section, select Only specific people or groups have write access and add users or respective groups, and in the Merge access via pull requests section  select Only specific people or groups have merge access and add users or group members.

  1. In the merge check section, enable Minimum number of approvals to 1 or greater than 1

  2. Save the branch restriction.


Backout Plan:

  1. Log in to Bitbucket with repository administrator privileges.

  2. Navigate to Repository Settings.

  3. Select Branch Restrictions.

  4. Locate the branch restriction configured during implementation.

  5. Remove or modify the restriction.

  6. Save the changes.

  7. Confirm normal repository operations after the rollback.


References: