SCM Protection Policies

This feature is only available on Chainloop’s platform paid plans.

While using the Chainloop CLI Enterprise Edition to gather the extended runner context Chainloop allows you to define policies that verify the good practices and security configuration related to your CI/CD environment.

Supported policies

The following policies are supported and can be used with the runner context data.

Branch protection

branch-deletion-blocked - Ensures that branch deletion is blocked to protect important branches from accidental deletion.
branch-force-push-blocked - Ensures that force pushes are blocked on branches to prevent bypassing code review and history integrity.
branch-linear-history-required - Ensures that branches require linear history to prevent merge commits and maintain a clean commit history.
repository-rules-change-restricted - Ensures that repository rules can only be changed by approved teams, protecting against unauthorized modifications to security policies.

Policy	What it checks	GitHub classic setting	GitHub ruleset rule	GitLab setting	GitLab tier
`branch-deletion-blocked`	The branch cannot be deleted	Uncheck Allow deletions	Check Restrict deletions	The branch is protected	All tiers
`branch-force-push-blocked`	Force pushes to the branch are blocked	Uncheck Allow force pushes	Check Block force pushes	The branch is protected and Allowed to force push is off (the default)	All tiers
`branch-linear-history-required`	The branch history has no merge commits	Check Require linear history	Check Require linear history	Project merge method is Fast-forward merge or Merge commit with semi-linear history. Also protect the branch to block direct pushes	All tiers
`repository-rules-change-restricted`	Only authorized users and teams can change or remove branch protection	Admins and custom roles with the Edit repository rules permission	Admins and custom roles with the Edit repository rules permission	Allowed to unprotect on each protected branch (set through the protected branches API)	Premium or Ultimate

On GitHub, new rulesets start as Disabled: set the enforcement status to Active or the policies do not see the ruleset. To allow specific users or teams to change branch protection, set the allowlist input of repository-rules-change-restricted (authorized_admins in the branch-protection policy group). On GitHub, use user:<login> (or collaborator:<login>) and team:<team-slug>, for example user:alice,team:security. On GitLab, use role names such as Maintainers, user display names or group names. A GitLab allowlist replaces the default Maintainers, so list Maintainers explicitly to keep it.

Pull request protection

pr-code-owner-review-required - Ensures that code owner reviews are required for pull requests.
pr-conversation-resolution-required - Ensures that all conversations on pull requests must be resolved before merging.
pr-review-required - Ensures that pull requests require a minimum number of reviewers before merging.
pr-stale-reviews-dismissed - Ensures that stale pull request reviews are automatically dismissed when new commits are pushed.

These policies check the repository settings, not a specific pull request. To check the approvals of a pull request, use pr-min-approvals.

Policy	What it checks	GitHub classic setting	GitHub ruleset rule	GitLab setting	GitLab tier
`pr-review-required`	Minimum number of approvals required before merging (the highest value that applies to the branch)	Required number of approvals before merging	Required approvals in Require a pull request before merging	Approvals required in an approval rule whose target branch is the branch or All protected branches. Rules that target All branches are not read	Premium or Ultimate
`pr-stale-reviews-dismissed`	Approvals are dismissed when new commits are pushed	Dismiss stale pull request approvals when new commits are pushed	Same option in Require a pull request before merging	Project approval setting When a commit is added set to Remove all approvals	Premium or Ultimate
`pr-code-owner-review-required`	Changes to files with code owners need a code owner’s approval (owners come from a `CODEOWNERS` file)	Require review from Code Owners	Require review from Code Owners	Code owner approval on the protected branch	Premium or Ultimate
`pr-conversation-resolution-required`	All review conversations must be resolved before merging	Require conversation resolution before merging	Require conversation resolution before merging in Require a pull request before merging	Merge check All threads must be resolved (a project setting, applies to every branch)	All tiers

Commit protection

commits-signed-required - Ensures that all commits are signed to verify their authenticity and integrity.

Policy	What it checks	GitHub classic setting	GitHub ruleset rule	GitLab setting	GitLab tier
`commits-signed-required`	The branch rejects unsigned commits	Require signed commits	Require signed commits	Push rule Reject unsigned commits	Premium or Ultimate

Once signed commits are required on GitHub, Rebase and merge cannot be used in the GitHub UI because GitHub cannot sign rebased commits. On GitLab, commits created in the UI or API are still accepted unsigned.

Using the policy groups

The branch protection policies and the code review policies are also available as the branch-protection and code-review policy groups. Both evaluate the runner-context material, so name it that way when you add it to the attestation.

policyGroups:
  - ref: branch-protection
    with:
      branches: "main"

policyGroups:
  - ref: code-review
    with:
      branches: "main"
      min_reviewers: "2"

Branch patterns. The branches input is a comma-separated list of patterns, for example main,release/*. * matches within one path segment (release/* matches release/1.0 but not release/1.0/hotfix) and ** also crosses /. If branches is not set, every branch in the runner context is checked, including unprotected feature branches, so set it to the branches you protect. The --branches flag of chainloop gather-runner-context uses the same rule.

GitLab notes.

Protected branches cannot be deleted with Git, but Maintainers and Owners can still delete them from the GitLab UI or API. branch-deletion-blocked passes when the branch is protected.
Merge commit with semi-linear history passes branch-linear-history-required, but it still adds a merge commit for every merge. Use Fast-forward merge for a strictly linear history.
Allowed to unprotect is available on GitLab Premium and Ultimate and can only be set through the protected branches API.
Protected branch settings are in Settings > Repository > Branch rules (Protected branches on older GitLab versions).

Pull request quality

These policies evaluate built-in attestation metadata captured automatically by Chainloop and do not require runner context data.

pr-description-required - Ensures that pull requests have a description providing context about the changes.
pr-user-story-linked - Ensures that pull requests are linked to a user story or issue for traceability.

Tag protection

tag-deletion-blocked - Ensures that tag deletion is blocked to prevent supply chain attacks via tag manipulation.
tag-force-push-blocked - Ensures that force pushes to tags are blocked to prevent tag history rewriting.
tag-rules-change-restricted - Ensures that tag protection rules can only be changed by authorized actors.

These policies are also available as the tag-protection policy group, which bundles all three together:

policyGroups:
  - ref: tag-protection
    with:
      tags: "v**"
      authorized_bypass: "role:Repository Admin"

Patch management

patch-policy-present - Verifies that automated patch management tooling is configured and actively monitoring third-party dependencies for known vulnerabilities. On GitHub, checks that Dependabot security updates are enabled. On GitLab, checks for the presence of a Renovate configuration file.

This policy evaluates the runner context data and can be added to your existing SCM configuration check contract:

policies:
  materials:
    - ref: patch-policy-present

Immutable releases

immutable-releases-enabled - Verifies that GitHub Immutable Releases is enabled for the repository. When enabled, published release artifacts and their associated tags cannot be modified or deleted, protecting the integrity of the software supply chain. This is a GitHub-specific feature; the policy skips on GitLab repositories.

policies:
  materials:
    - ref: immutable-releases-enabled

Bot PR verification

pr-bot-author-allowed - Verifies that a PR/MR was authored by one of the allowed bot accounts. Useful for gating workflows that should only accept PRs from automated tools such as Dependabot or Renovate.

This policy evaluates CHAINLOOP_PR_INFO metadata and accepts an optional allowed_bots input (comma-separated list of bot login names). If not specified, it defaults to dependabot[bot] and renovate[bot].

On GitLab, bot detection relies on the author.bot field from the Merge Request API. Regular user accounts used for automation (e.g., Renovate with a PAT) will not be detected as bots unless provisioned as a GitLab service account. Adding a regular user’s login to allowed_bots has no effect, because the policy skips any author that is not a bot. See the Gating Bot-Authored PRs guide for details.

GitHub
GitLab

policies:
  materials:
    - ref: pr-bot-author-allowed
      gate: true
      with:
        allowed_bots: "dependabot[bot],github-actions[bot]"

policies:
  materials:
    - ref: pr-bot-author-allowed
      gate: true
      with:
        allowed_bots: "project_123_bot_abc123"

Getting Started

Concepts

Guides

References

Misc

Supported policies

Branch protection

Pull request protection

Commit protection

Using the policy groups

Pull request quality

Tag protection

Patch management

Immutable releases

Bot PR verification

​Supported policies

​Branch protection

​Pull request protection

​Commit protection

​Using the policy groups

​Pull request quality

​Tag protection

​Patch management

​Immutable releases

​Bot PR verification

Supported policies

Branch protection

Pull request protection

Commit protection

Using the policy groups

Pull request quality

Tag protection

Patch management

Immutable releases

Bot PR verification