Description

Ensure the Git branch that a Render Blueprint (render.yaml) syncs from has branch protection in the Git provider that requires at least one code review before changes are merged. This applies to every Blueprint that manages resources in a protected environment.

Rationale

Render notes that non-Admin members can still change resources in a protected environment by publishing an update to the corresponding render.yaml file. Without code review, anyone who can push to the branch could change or remove production resources through the Blueprint, bypassing the protection.

Impact

  • Blueprint changes to production must be reviewed

  • Closes the gap where render.yaml can bypass environment protection

  • Merges to the Blueprint branch take longer

Default Value

Render does not require code review. Branch protection must be set up in your Git provider.

Pre-Requisites

  • Admin access to the Git repository

  • A list of Blueprints that manage protected environments

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Open Blueprints from your workspace home and note the repository and branch of each Blueprint that manages protected resources.

  3. In your Git provider, open the repository's branch protection settings and check that the branch requires pull request reviews before merging.

  4. If review is not required, follow the implementation steps.

Implementation Steps

  1. In your Git provider, open the repository settings and add a branch protection rule (or ruleset) for the Blueprint's branch.

  2. Require a pull request with at least one approving review before merging, and block direct pushes.

  3. Save the rule and confirm a direct push to the branch is rejected.

Backout Plan

  1. In your Git provider, edit or remove the branch protection rule for the branch.

Reference