Description

Ensure the Git branch that each Render workflow builds its tasks from has branch protection requiring code review before merge, so only reviewed task code is built and run.

Rationale

Workflow tasks run code from the linked branch. If anyone can push to that branch directly, unreviewed or malicious code can run with access to the workflow's secrets and connected systems. Branch protection makes sure every change is reviewed first.

Impact

  • Only reviewed task code runs

  • Reduces the risk of malicious changes

  • Changes take longer because of the review step

Default Value

Render does not require code review. Branch protection must be set up in your Git provider.

Pre-Requisites

  • Admin access to the Git repository

  • Admin or Developer role on the workflow

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Open each workflow and note the repository and branch in its Settings.

  3. In your Git provider, check that the branch requires pull request reviews before merging.

  4. If it does not, follow the implementation steps.

Implementation Steps

  1. In your Git provider, add a branch protection rule for the workflow's branch that requires at least one approving review and blocks direct pushes.

  2. Save the rule and confirm a direct push is rejected.

Backout Plan

  1. Edit or remove the branch protection rule in your Git provider.

Reference