Beyond the News
Sign in
Web DevelopmentCloud & InfrastructureDeployment & DevOpsDeveloper Tools Active dossier

GitHub can now make unresolved secret leaks a hard pull-request merge blocker

GitHub has added a repository-ruleset control that blocks pull requests from merging until secret scanning finishes and every newly introduced secret alert is resolved. The public-preview rule turns secret detection into an enforceable merge gate rather than relying only on push-time protection or reviewer discipline.

Reviewed and published by Lars Jansen Updated 4 min read
Comment
First published

Key details

  1. GitHub announced the rule on September 9, 2026.
  2. The rule type is `require_secret_scanning_alert_resolution`.
  3. A pull request is blocked until secret scanning completes on its head commit.
  4. Open secret alerts introduced by the pull request must be resolved before merge.
  5. Provider patterns are covered by default; custom and generic patterns can also be selected.
  6. Repository, organization and enterprise rulesets are supported.
  7. REST and GraphQL configuration are supported.
  8. The feature is in public preview for GitHub Secret Protection or GitHub Advanced Security customers.

What builders should take away

  1. Use the merge rule as a backstop even if push protection is already enabled; the two controls operate at different points.
  2. Expect merge queues and automation to wait for secret scanning completion, and monitor scan latency as part of delivery health.
  3. Apply the rule centrally where possible so critical repositories do not depend on local administrator discipline.
  4. Keep bypass permissions narrow and auditable, because bypass rights become the escape hatch from the secret gate.
  5. Test custom/generic patterns carefully before enforcing them broadly to avoid noisy false-positive merge blocks.

What changed

On September 9, GitHub added a new repository ruleset rule, `require_secret_scanning_alert_resolution`, for customers with GitHub Secret Protection or GitHub Advanced Security. When enabled, a pull request cannot merge until a secret scan has completed on the head commit and no open secret-scanning alerts introduced by the pull request remain unresolved. Provider-pattern secrets are included by default, with optional blocking for custom or generic patterns. The rule can be configured at repository, organization or enterprise level and through REST or GraphQL APIs. It is currently in public preview.

Why it matters

Secret scanning has traditionally warned or blocked earlier in the workflow, but real repositories still receive pull requests through paths where a secret can reach review. Making unresolved alerts a merge-policy condition gives security teams an enforceable final gate and lets large organizations roll that control across repositories centrally. It also changes CI/review expectations: a merge can now remain blocked because scanning has not completed, not only because a secret was confirmed.

The merge gate checks both scan completion and alert state

GitHub requires the head commit to finish secret scanning before the rule passes. It then checks whether the pull request introduced any still-open secret alerts. Developers without bypass rights must resolve those alerts before merging.

This complements rather than replaces push protection

Push protection tries to stop a secret before it enters the repository. The new ruleset acts later at pull-request merge time, covering a different workflow boundary and giving organizations a final enforcement point.

Central rollout is part of the value

The rule can live in repository, organization or enterprise rulesets and can be managed through REST or GraphQL. That makes it suitable for policy-as-code and fleet-wide governance rather than one-off repository configuration.

What to watch next

  • When the rule becomes generally available.
  • Whether GitHub adds finer bypass/audit controls or merge-queue integrations.
  • Operational evidence on secret-scan latency and false-positive impact at large repository fleets.
  • Whether the rule expands to additional secret-detection providers or policy sources.

Still unclear

  • The control is public preview and may change before GA.
  • Blocking effectiveness depends on the secret patterns enabled and the quality of secret-scanning detection.
  • The rule prevents merge while an alert remains open; it does not rotate or invalidate an exposed credential automatically.

Sources

Direct reading behind this dossier.

1 sources

Discussion

Discussion is reader-contributed. Comments are not part of the BTN dossier or its editorial evidence.

0 visible comments

Join the discussion

Keep comments useful and relevant. Reader contributions may be moderated and are not BTN editorial evidence.

Sign in to comment
Continue reading
Web Development

GitHub Actions makes cache access a least-privilege workflow permission

The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.

Artificial Intelligence

GitHub Copilot code review can now approve pull requests

Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.