> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-53.md).

# Required reviews can be bypassed using GitHub Actions

## Rule Details

|                       |                        |
| --------------------- | ---------------------- |
| Cortex AppSec Rule ID | APPSEC\_CICD\_53       |
| Category              | Flow Control Mechanism |
| Severity              | HIGH                   |

## Impact

Requiring pull requests and approvals helps prevent unreviewed changes from reaching sensitive branches. However, when CI/CD workflows are allowed to run and are granted write permissions, a user with repository write access can create a workflow that automatically approves and merges their own pull request. This lets the workflow author approve their own changes and merge unreviewed code into protected branches, effectively bypassing mandatory review controls.

## Recommended Solution - Buildtime

If GitHub Actions is not used to approve pull requests, disallow it at the organization level:

1. Browse to the **Actions** page under the GitHub organization settings.
2. Clear the **Allow GitHub Actions reviews to count towards required approval** setting.

This will protect all organization repositories against the bypass.

If GitHub Actions is used to approve pull requests, ensure required reviews cannot be bypassed by following the guidelines below:

1. Disable Actions in repositories where it is not in use:
2. Browse to **Organization Settings**.
3. Click Actions, and under Policies, restrict to specific repositories.
   1. For repositories where GitHub Actions is enabled:
4. Require a review approval in pull requests from Code Owners. This can be done by checking the **Require review from Code Owners** setting in the repository branch protection rule.
5. In cases where requiring approval from code owners is not possible, increase the required number of approvals to two or more, under the branch protection rule settings.

This will prevent a single author from pushing unreviewed code to the target branch.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-53.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.