How to resolve Sprinto check for enabling branch protection rules
Learn how to configure branch protection rules across GitHub, GitLab, Bitbucket, Azure DevOps, and AWS CodeCommit to resolve Sprinto repository protection checks.
About
Sprinto check: Branch Protection rules should be enforced for admins
This Sprinto check activates upon integrating your code hosting service with Sprinto, triggering when no branch protection rules are configured on your integrated service provider account. Branch protection rules are essential security configurations designed to safeguard production code, ensuring that changes undergo thorough review before being pushed.
Purpose
The purpose of this check is to guarantee the implementation of proper security configurations, such as code peer review and merge request approval, on repositories hosting production code. This method introduces an additional layer of security, preventing any sudden or malicious changes from being pushed to the code repository. Branch protection rules contribute to meeting the data compliance requirements associated with change management.
How to resolve
To resolve this sprint check, you need to enable the branch protection rules on your code hosting service. Follow the below procedure for various code hosting services that you use.
1. Github
Follow the below procedure to enable branch protection rules on Github:
Video Guide
Before you begin
Ensure you are on the Team plan on GitHub.
Ensure you have “Admin” privileges on your GitHub account to modify security configuration.
Procedure
Log in to Github with your credentials, and navigate to the main page of the repository.
Under the repository name, click on Settings.
On the sidebar under the Code and Automation section, click Branches.
Click Add rule next to the Branch protection rules.
Under the Branch name pattern, type the branch name or pattern you want to protect.
Enable required pull request approvals
Select Require a pull request before merging.
Select Require approvals.
Set the required number of approvals to at least 1.
Note
Sprinto validates whether pull request approvals are enforced for protected branches. If Require approvals is disabled or the approval count is set to 0, the Sprinto check may continue to fail even if other branch protection settings are enabled.
Select Require status checks to pass before merging.
Note
In case you cannot enable the status check rule, you can request Sprinto support to disable this check for you.
Select Do not allow bypassing the above settings to enforce these to administrators.
Ensure Dependabot, a free Dependency Vulnerability scanner, is enabled on all production repositories.
Go to the repository main page on your GitHub account.
Under your repository name, click Settings.
On the sidebar under the Security section, click Code Security and analysis.
On Code security and analysis page, click Enable next to Dependabot alerts.
2. Gitlab
Follow the below procedure to enable branch protection rules on Gitlab:
Video Guide
Before you begin
Ensure you are on the Gitlab premium plan.
Ensure you have “Admin” privileges on the Gitlab account to modify security configuration.
Procedure
Note: Repeat the procedure below for each Gitlab project and group with code repositories with production-side code.
Go to Projects > Your Project.
Go to Settings > Repositories > Protected branches:
Ensure the required checks are in place.
Go to Settings > General > Merge Request:
Ensure the required checks are in place.
Now, from main menu, go to Groups > Your groups.
Select a project with production repositories, and :
Click on Settings > General > Merge Request Approvals.
Set the number of approvals required to 1.
Click on Add approval rule.
Configure approval settings.
3. Bitbucket
Follow the below procedure to enable branch protection rules on Bitbucket:
Before you begin
Ensure you are on the Bitbucket premium plan.
Ensure you have “Admin” access on the Bitbucket account to modify the security configuration.
Procedure
Log in to your Bitbucket account.
Click on Repositories under the main menu.
Click Repository settings.
On the sidebar, under the Workflow section, click Branch Restrictions.
Create or edit the restriction for each production branch.
Select the Merge settings tab.
Configure the following settings. Each monitor passes only when its listed settings are enabled:
Monitor 1: Peer review should be enforced for code changes
Set the minimum number of approvals to 1.
Select Prevent a merge with unresolved merge checks.
Monitor 2: Branch protection rules should be enforced for admins
Select Only specific people or groups have write access.
Select Prevent a merge with unresolved merge checks.
Monitor 3: Merging of code changes should require passing status checks
Set the minimum number of successful builds to 1.
Select Prevent a merge with unresolved merge checks.
Click Save.
4. AWS CodeCommit
Follow the below procedure for enabling branch protection rules on AWS CodeCommit:
Before you begin
Approval rules for pull requests.
Managed policies for approval rule templates.
Procedure
Refer to AWS CodeCommit documentation for setting up approval rule templates. See Permissions for actions on approval rule templates and AWS-managed policies for CodeCommit.
5. Azure DevOps
Follow the below procedure to enable branch policies on Azure DevOps:
Before you begin
Ensure you have access to manage the branch policies on Azure DevOps.
Ensure that the policies are enabled at the branch level.
Procedure
Select Repos > Branches in the Azure DevOps web portal to manage branch policies.
Search for the branch and choose Branch policies.
Enable Require a minimum number of reviewers and set the required number (at least 1).
Scroll to Status Checks → click + Add.
Complete the required fields (for example, Status to check) and click Save.
Applying these branch protection rules ensures a secure and compliant development practice across all production repositories tracked by Sprinto. Sprinto retrieves the changes and sets the Sprinto check for branch protection to “Passing.” If you need any assistance with the Sprinto check, please get in touch with Sprinto Support.
Last updated