# Ensure workflows build from a protected branch

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876667220603-ensure-workflows-build-from-a-protected-branch
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Git branch that each Render workflow builds its tasks from has branch protection requiring code review before merge, so only reviewed task code is built and run.

**Rationale**

Workflow tasks run code from the linked branch. If anyone can push to that branch directly, unreviewed or malicious code can run with access to the workflow's secrets and connected systems. Branch protection makes sure every change is reviewed first.

**Impact**

-   Only reviewed task code runs
    
-   Reduces the risk of malicious changes
    
-   Changes take longer because of the review step
    

**Default Value**

Render does not require code review. Branch protection must be set up in your Git provider.

**Pre-Requisites**

-   Admin access to the Git repository
    
-   Admin or Developer role on the workflow
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Open each workflow and note the repository and branch in its Settings.
    
3.  In your Git provider, check that the branch requires pull request reviews before merging.
    
4.  If it does not, follow the implementation steps.
    

**Implementation Steps**

1.  In your Git provider, add a branch protection rule for the workflow's branch that requires at least one approving review and blocks direct pushes.
    
2.  Save the rule and confirm a direct push is rejected.
    

**Backout Plan**

1.  Edit or remove the branch protection rule in your Git provider.
    

**Reference**

-   [https://render.com/docs/workflows](https://render.com/docs/workflows)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.