Description

Detects when the protection rule of a GitHub repository's default branch requires no status check to pass before merging. Builds, tests and security scans then become advisory: a pull request whose pipeline failed can still be merged into the branch the organization releases from.

Detection Strategy

• Lists every repository in the GitHub organization, taking the default branch name and the caller's permissions from the listing itself

• Skips repositories where the credential lacks admin permission, since branch protection cannot be read without it

• Counts the required status checks declared in the branch protection settings, reading the checks field rather than the contexts field it replaces

• Reports a vulnerability when no status check is required, whether the setting is absent or present with an empty list