Repository does not dismiss pull request approvals on the default branch when new commits are pushed

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_152
Category	Flow Control Mechanism
Severity	MEDIUM

Impact

When a pull request is approved, it means that the code changes have been reviewed and can be merged into the target branch. However, if new commits are added to the request after it has been approved, those commits are not automatically required to be reviewed again. This can lead to bypassing a branch protection rule by merging unreviewed commits into the default branch, potentially introducing malicious code.

Recommended Solution - Buildtime

It is recommended to configure branch protection rules to dismiss pull request approvals when new commits are pushed.

1. In GitHub, browse to the repository Settings > Branches.

2. Ensure or add a branch protection rule on the default branch.

3. Under Protect matching branches, select Requires a pull request before merging.

4. Check Dismiss stale pull request approvals when new commits are pushed.

   Note: This option is available after performing step 3 above.