Description
Ensure that every web service with auto-deploy enabled is linked to a Git branch that has branch protection requiring code review before merge. Optionally, set auto-deploy to deploy only after CI checks pass.
Rationale
With auto-deploy on, every commit to the linked branch goes straight to the running service. If that branch accepts direct pushes without review, unreviewed or malicious code can reach production in minutes. Requiring review on the branch makes sure every deployed change has been checked.
Impact
Only reviewed code is deployed automatically
Reduces the risk of unreviewed or malicious changes
Merges take longer because of the review step
Default Value
New Git-based services use the On Commit auto-deploy setting by default, which deploys every commit to the linked branch.
Pre-Requisites
Admin or Developer role on the service
Admin access to the Git repository
Remediation
Test Plan
Sign in to the Render Dashboard at https://dashboard.render.com.
From your workspace home (or project), click the service to open it.
Open the service's Settings page and note the Branch and the Auto-Deploy setting (On Commit, After CI Checks Pass, or Off).
If auto-deploy is on, check in your Git provider that the branch requires pull request reviews before merging.
If it does not, follow the implementation steps.
Implementation Steps
In your Git provider, add a branch protection rule for the linked branch that requires at least one approving review and blocks direct pushes.
Sign in to the Render Dashboard at https://dashboard.render.com.
From your workspace home (or project), click the service to open it.
Optionally, on the service's Settings page, set Auto-Deploy to After CI Checks Pass (autoDeployTrigger: checksPass in render.yaml). Note that Render does not deploy if zero CI checks are detected.
Backout Plan
Remove or relax the branch protection rule in your Git provider, or set Auto-Deploy back to its previous value in the service's Settings.
Reference