change/human-review-required

Install

Reads

github.repos, github.branch_rules, github.actions_permissions

Fix when it fails

Require at least one approval on main, dismiss stale approvals, stop workflows approving pull requests, and remove bypass.

Maps to

SOC2:CC8.1, ISO27001:A.8.32

Test cases

Drill file

firedrill: v0
id: change/human-review-required
safeguard: "A human approves every change to main, and new pushes reset approval."
severity: high
for_each: github.repos
fetch:
  rules: { fact: github.branch_rules, args: { branch: default } }
  bots:  { fact: github.actions_permissions }
applies_when: target.protection_available
na_reason: "the plan has no branch protection on private repos"
pass_when:
  - rules.required_approvals >= 1
  - rules.dismiss_stale == true
  - bots.can_approve_pull_requests == false
  - rules.bypass != "allowed"
warn_when:
  - rules.bypass == "unknown"
fix: "Require at least one approval on main, dismiss stale approvals, stop workflows approving pull requests, and remove bypass."
maps_to: [SOC2:CC8.1, ISO27001:A.8.32]