BEFORE DIVING IN
Please note that inherited permissions are not supported at this time, thus items such as inherited branch restrictions, can not be retrieved by Drata.
ASSOCIATED DRATA CONTROL
This test is part of the Code Review Process control that ensures all application code changes, reviews, and tests are performed by someone other than the person who made the initial code change.
WHAT TO DO IF A TEST FAILS
If Drata finds that branch configurations allow code changes merged by the same user into the main branch of your version control system, without any other user interaction, the test will fail. With a failed test you will receive a notification from Drata stating that there are code repositories that allow code changes to be merged into the main branch without being reviewed by another team member.
To remediate a failed test, you will need to make sure that a code reviewer is assigned to each merge request, and that reviews cannot be bypassed. It is also recommended to enable a policy on the main branch that requires reviews on all merge requests.
STEPS TO REMEDIATE
To ensure a validated state when testing for the formal code review process, please follow the steps listed in the table below. Once the provider steps have been completed, navigate back to Drata and execute the test.
Provider | Provider Steps |
AWS CodeCommit | As the Admin:
|
Azure DevOps Repos | Branch Policies on the default branch must include at least one reviewer, and the checkbox for "Allow requestors to approve their own changes" is off. OR
Branch Policies on the default branch includes at least two reviewers. |
Bitbucket | Both branch match kinds are supported. If you're setting up branch protection by name (i.e. you selected the option "By name or pattern" at the top of your branch permissions):
In contrast, if you're setting up branch protection by type (i.e. you selected the option "By Type"):
Then, apply the following two settings:
|
GitHub | As the owner:
|
GitLab NOTE 1: Repos on the (legacy) GitLab Bronze plan cannot pass this test. Accounts must be on at least the (legacy) Silver or Premium tier.
NOTE 2: Changes have been made to how we evaluate Approval Rules as of 08/08/2024. The logic described is how to pass this test as of that date. | As the owner, go to each of the connected projects.
Verify or Add a Protected Branch
Hierarchy of Approval Rule Checks
Example approval rule targeting
Example approval rule targeting
NOTE: If one of your repos shows an error message of "Request failed with status code 404" in the raw test evidence, this means no protected branches have been defined for this repo. You should define at least one according to the instructions above and rerun the test. |
HELPFUL RESOURCES