Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt

Use this file to discover all available pages before exploring further.

FieldValue
CategoryCICD-SEC-1
SeverityMEDIUM
Auto-fix✗
SourceRepository configuration

​
What the check does

Reads the branch protection rule and reports when required_pull_request_reviews.dismiss_stale_reviews is false.

​
Why it matters

Without stale-review dismissal:
  1. Author opens a clean PR.
  2. Reviewer approves it.
  3. Author force-pushes additional malicious commits.
  4. PR is now merge-eligible — the approval still counts, even though the reviewed commit is no longer the HEAD.
This is the most common branch-protection bypass in the wild — defeats reviews without needing to compromise any account.

​
How to fix

Settings → Branches → edit the rule → under Require a pull request before merging, enable Dismiss stale pull request approvals when new commits are pushed.