-
Notifications
You must be signed in to change notification settings - Fork 565
Closed
Labels
Description
Is your feature request related to a problem? Please describe.
GitHub has recently released Repository Rules as an alternative to Branch Protection rules.
These rules can be queried without administrator access, so Scorecard can determine if a third party repository is branch-protected, and ossf/scorecard-action
can produce better results with default tokens.
Describe the solution you'd like
The Branch Protection checks should be modified to fetch and score protections provided through Repository Rules in addition to Branch Protection rules. Support was added to go-github in google/go-github#2789 .
Describe alternatives you've considered
- Wait: the feature is very new, and so unlikely to be well adopted.
- Continue using only branch protection rules: this will produce false negatives for repositories using Repository Rules.
Additional context
- Announcement https://github.blog/changelog/2023-07-24-repository-rules-are-generally-available/
- Blog post https://github.blog/2023-07-24-github-repository-rules-are-now-generally-available/
- Documentation: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets