~4 min to deploy

GitHub Branch-Protection Gate

Require review before a force push. Blocks history rewrites on protected branches and escalates protection-setting changes.

For: Repo admins who want branch protection to be provable, not just configured

SOC 2 CC8.1ISO 27001 A.8.32Source-control evidence

What it enforces

Force-push review requirement

Escalates a force push to a protected branch until a named reviewer signs it.

History-rewrite block

Blocks a rewrite of already-published history on a protected branch.

Protection-setting change escalation

Escalates any change to the branch-protection settings themselves.

Deploy in Shadow Mode

github-branch-protection-gate.yaml

# GitHub Branch-Protection Gate
# Fork: set protected_branches, then flip mode to enforce when the shadow
# verdicts look right.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
  name: github-branch-protection-gate
  surface: github
  workflow_key: github_branch_protection
  standards: [SOC2-CC8.1, ISO27001-A.8.32]
defaults:
  mode: shadow
  emit_dossier: true
  comment_pr: true
protected_branches: [main, master, release/*, production]
rules:
  - name: force_push_review_requirement
    when: "event == 'push'"
    decision: |
      ESCALATE IF push.forced == true AND ref in protected_branches
      ALLOW OTHERWISE
    reason_code: force_push_requires_review
  - name: history_rewrite_block
    when: "event == 'push'"
    decision: |
      BLOCK IF push.rewrites_published_history == true AND ref in protected_branches
      ALLOW OTHERWISE
    reason_code: published_history_rewrite
  - name: protection_setting_change
    when: "event == 'branch_protection_rule'"
    decision: |
      ESCALATE IF always
    reason_code: branch_protection_changed

Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.

How to install it

Drops into any workflow YAML in one line. Verdicts surface on the PR + the run summary.

GitHub Action — shadow mode

# .github/workflows/deploy.yml
- uses: decionis/govern@v1
  with:
    api-key: ${{ secrets.DECIONIS_API_KEY }}
    org-id:  ${{ secrets.DECIONIS_ORG_ID }}
    workflow-key: github_deploy_approval
    mode: shadow          # ← every verdict recorded; step never fails
    comment-pr: 'true'    # ← post verdict + verify URL on the PR

Add the GitHub ActionShips in shadow mode — every verdict is recorded, nothing is blocked.

Loading…

Open-Policy Exchange