Required reviews can be bypassed using GitHub Actions

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_53
Category	Flow Control Mechanism
Severity	HIGH

Impact

Requiring pull requests and approvals helps prevent unreviewed changes from reaching sensitive branches. However, when CI/CD workflows are allowed to run and are granted write permissions, a user with repository write access can create a workflow that automatically approves and merges their own pull request. This lets the workflow author approve their own changes and merge unreviewed code into protected branches, effectively bypassing mandatory review controls.

Recommended Solution - Buildtime

If GitHub Actions is not used to approve pull requests, disallow it at the organization level:

1. Browse to the Actions page under the GitHub organization settings.
2. Clear the Allow GitHub Actions reviews to count towards required approval setting.

This will protect all organization repositories against the bypass.

If GitHub Actions is used to approve pull requests, ensure required reviews cannot be bypassed by following the guidelines below:

1. Disable Actions in repositories where it is not in use:
2. Browse to Organization Settings.
3. Click Actions, and under Policies, restrict to specific repositories.

   1. For repositories where GitHub Actions is enabled:
4. Require a review approval in pull requests from Code Owners. This can be done by checking the Require review from Code Owners setting in the repository branch protection rule.
5. In cases where requiring approval from code owners is not possible, increase the required number of approvals to two or more, under the branch protection rule settings.

This will prevent a single author from pushing unreviewed code to the target branch.