Skip to content

Feature: Branch-Protection check should include Repository Rules #3326

@thepwagner

Description

@thepwagner

Is your feature request related to a problem? Please describe.

GitHub has recently released Repository Rules as an alternative to Branch Protection rules.
These rules can be queried without administrator access, so Scorecard can determine if a third party repository is branch-protected, and ossf/scorecard-action can produce better results with default tokens.

Describe the solution you'd like

The Branch Protection checks should be modified to fetch and score protections provided through Repository Rules in addition to Branch Protection rules. Support was added to go-github in google/go-github#2789 .

Describe alternatives you've considered

  • Wait: the feature is very new, and so unlikely to be well adopted.
  • Continue using only branch protection rules: this will produce false negatives for repositories using Repository Rules.

Additional context

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions