Branch Protection Policy

Branch Protection Policy

Repository: zrlopez/ml-incident-response-playbook
Branch: main
Last reviewed: 2026-05-28
Owner: @zrlopez

This document describes the required GitHub branch protection settings for main. A reviewer can verify the current configuration at: Settings → Branches → main → Edit

Required Status Checks

The following CI jobs must pass before any PR can merge:

Job NameWorkflowPurpose
secrets-scansecured_ci.ymlTruffleHog credential scan
dependency-auditsecured_ci.ymlpip-audit CVE gate
lockfile-checksecured_ci.ymlrequirements.txt freshness (CI-53)
sastsecured_ci.ymlBandit + mypy + Semgrep
unit-testssecured_ci.ymlpytest unit suite (fail_under=80)
integration-testssecured_ci.ymlpytest integration suite (fail_under=40)
container-scansecured_ci.ymlTrivy CRITICAL/HIGH hard gate + SBOM

Branch Protection Rules

GitHub Settings → Branches → main
  • Require a pull request before merging
    • Require approvals: 1 (self-review for solo project — waived; enforce for team)
    • Dismiss stale pull request approvals when new commits are pushed
  • Require status checks to pass before merging
    • Require branches to be up to date before merging
    • Required checks: (see table above)
  • Require conversation resolution before merging
  • Require signed commits
    • Enforces GPG/SSH commit signing; prevents commit spoofing
    • Local setup: git config --global commit.gpgsign true
  • Do not allow bypassing the above settings
  • Restrict who can push to matching branches
    • Recommended for team repos: restrict to @zrlopez + CI service accounts
    • Currently waived for solo portfolio development velocity

CODEOWNERS Enforcement

All security-sensitive paths require explicit approval from @zrlopez. See .github/CODEOWNERS for the full path list.

To activate: Settings → Branches → main → Require review from Code Owners

Signed Commits

All commits to main should be GPG or SSH signed. Steps to configure locally:

# Generate a signing key (if not already done)
gpg --full-generate-key
 
# Configure git to use it
git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true
 
# Verify signing is active
git log --show-signature -1

For SSH signing (simpler):

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

Related

  • .github/CODEOWNERS — path-level ownership rules
  • .github/workflows/secured_ci.yml — full CI pipeline
  • SECURITY.md — vulnerability disclosure policy
  • docs/adr/ADR-002-jwt-algorithm-selection.md — RS256 signing rationale
Remediation LogDashboard Spec