complytime/repo-branch-protection Control Catalog

complytime/repo-branch-protection

Branch protection controls for GitHub/GitLab repositories

Published by ComplyTime

License No license declared

Install

OCI v1.1

$grcli unpack --repository complytime/repo-branch-protection --version dev-20260527

grcli unpack verifies this signature against the recorded identity below and fails closed before writing any files — no separate verify step needed. Pass --no-verify to skip.

Coordinate: oci.grc.store/complytime/repo-branch-protection:dev-20260527
Manifest digest: sha256:53489838f56fb059c1ad9705ee8485544d4bed47d09aa73244d3be093e905b57
Signed by: no signature recorded

Identity recorded by this hub when the version was published; unpack (above) checks the signature against it.

Verify in CI — check the signature without downloading

$grcli verify --repository complytime/repo-branch-protection --version dev-20260527

Read-only: downloads nothing and exits non-zero if the signature or the recorded identity doesn't match — use it as an admission/policy gate.

Provenance

1 layer

Digest	Media type	Size
4d790e0b1954…	application/vnd.gemara.artifact.v1+yaml	2.6 KiB

Bundle config blob

{
  "bundle-version": "1.0",
  "gemara-version": "1.1.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "repo-branch-protection",
            "type": "ControlCatalog"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "complytime/repo-branch-protection",
            "tag": "dev-20260527"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/complytime-policies",
          "GITHUB_RUN_ATTEMPT": "2",
          "GITHUB_RUN_ID": "26524275168",
          "GITHUB_SHA": "35c30860a105d3c2572aade482dfdaa8a28312cc",
          "GITHUB_WORKFLOW": "Publish to grc.store",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "governance/catalogs/ampel-branch-protection-catalog.yaml",
            "uri": "file://governance/catalogs/ampel-branch-protection-catalog.yaml",
            "digest": {
              "sha256": "4d790e0b1954ded35c3dd53f8eb5d7b4d927db15b6fab3c01ff50612084db8e0"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/complytime-policies@35c30860a105d3c2572aade482dfdaa8a28312cc",
            "digest": {
              "gitCommit": "35c30860a105d3c2572aade482dfdaa8a28312cc"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/complytime-policies/actions/runs/26524275168",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.1.2"
          }
        },
        "metadata": {
          "invocationId": "26524275168-2",
          "startedOn": "2026-05-27T16:29:31.10981307Z",
          "finishedOn": "2026-05-27T16:29:31.743302325Z"
        },
        "byproducts": [
          {
            "name": "ampel-branch-protection-catalog.yaml",
            "digest": {
              "sha256": "4d790e0b1954ded35c3dd53f8eb5d7b4d927db15b6fab3c01ff50612084db8e0"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "ampel-branch-protection-catalog.yaml",
      "type": "ControlCatalog",
      "id": "repo-branch-protection",
      "role": "artifact"
    }
  ]
}

Branch Protection Controls

Branch protection controls for GitHub/GitLab repositories

ID: repo-branch-protection
Version: dev-20260527
Gemara version: 1.1.0
Author: ComplyTime

Source Code Protection

Controls for protecting source code repositories via branch protection rules

BP-1 Require Pull Request Reviews
Objective
Ensure changes to protected branches go through a pull request process
Assessment requirements
1. Direct pushes to protected branches MUST be blocked
  Applicability: github-repos, gitlab-repos
BP-2 Require Minimum Approvals
Objective
Pull requests to protected branches must have a minimum number of approvals
Assessment requirements
1. Pull requests must require a minimum number of approvals
  Applicability: github-repos, gitlab-repos
BP-3 Restrict Force Pushes
Objective
Force pushes to protected branches must be blocked
Assessment requirements
1. Force pushes to protected branches must be blocked
  Applicability: github-repos, gitlab-repos
BP-4 Prevent Admin Bypass
Objective
Admin bypass of branch protection rules must be prevented
Assessment requirements
1. Admin bypass prevention must be enabled on protected branches
  Applicability: github-repos, gitlab-repos
BP-5 Require Code Owner Review
Objective
Code owner review must be required when CODEOWNERS file exists
Assessment requirements
1. Code owner review requirements must be enabled
  Applicability: github-repos, gitlab-repos

# Branch Protection Controls

Version: dev-20260527

_Branch Protection Controls_ is a Gemara 1.1.0 ControlCatalog by ComplyTime (Software Assisted, `complytime`).

### Description

Branch protection controls for GitHub/GitLab repositories

### Requirement Applicability Groups

The following groups are used to specify the circumstance within which an assessment requirement is mandated.

- **github-repos** — GitHub Repositories: GitHub-hosted source code repositories
- **gitlab-repos** — GitLab Repositories: GitLab-hosted source code repositories

_Summary: 5 control(s), 5 assessment requirement(s)._

## Table of contents

- [Source Code Protection](#source-code)
  - [BP-1: Require Pull Request Reviews](#bp-1-require-pull-request-reviews)
  - [BP-2: Require Minimum Approvals](#bp-2-require-minimum-approvals)
  - [BP-3: Restrict Force Pushes](#bp-3-restrict-force-pushes)
  - [BP-4: Prevent Admin Bypass](#bp-4-prevent-admin-bypass)
  - [BP-5: Require Code Owner Review](#bp-5-require-code-owner-review)

## source-code: Source Code Protection

Controls for protecting source code repositories via branch protection rules
### BP-1: Require Pull Request Reviews

**Objective**

Ensure changes to protected branches go through a pull request process

#### BP-1.01

Direct pushes to protected branches MUST be blocked

**Applicability:** github-repos, gitlab-repos

### BP-2: Require Minimum Approvals

**Objective**

Pull requests to protected branches must have a minimum number of approvals

#### BP-2.01

Pull requests must require a minimum number of approvals

**Applicability:** github-repos, gitlab-repos

### BP-3: Restrict Force Pushes

**Objective**

Force pushes to protected branches must be blocked

#### BP-3.01

Force pushes to protected branches must be blocked

**Applicability:** github-repos, gitlab-repos

### BP-4: Prevent Admin Bypass

**Objective**

Admin bypass of branch protection rules must be prevented

#### BP-4.01

Admin bypass prevention must be enabled on protected branches

**Applicability:** github-repos, gitlab-repos

### BP-5: Require Code Owner Review

**Objective**

Code owner review must be required when CODEOWNERS file exists

#### BP-5.01

Code owner review requirements must be enabled

**Applicability:** github-repos, gitlab-repos

{
  "catalog": {
    "groups": [
      {
        "class": "family",
        "controls": [
          {
            "class": "source-code",
            "controls": [
              {
                "id": "BP-1.01",
                "parts": [
                  {
                    "id": "BP-1.01_smt",
                    "name": "statement",
                    "prose": "Direct pushes to protected branches MUST be blocked"
                  },
                  {
                    "id": "BP-1.01_obj",
                    "links": [
                      {
                        "href": "#BP-1.01_smt",
                        "rel": "assessment-for"
                      }
                    ],
                    "name": "assessment-objective"
                  }
                ],
                "title": "BP-1.01"
              }
            ],
            "id": "BP-1",
            "parts": [
              {
                "id": "BP-1_smt",
                "name": "statement",
                "prose": "Ensure changes to protected branches go through a pull request process"
              }
            ],
            "title": "Require Pull Request Reviews"
          },
          {
            "class": "source-code",
            "controls": [
              {
                "id": "BP-2.01",
                "parts": [
                  {
                    "id": "BP-2.01_smt",
                    "name": "statement",
                    "prose": "Pull requests must require a minimum number of approvals"
                  },
                  {
                    "id": "BP-2.01_obj",
                    "links": [
                      {
                        "href": "#BP-2.01_smt",
                        "rel": "assessment-for"
                      }
                    ],
                    "name": "assessment-objective"
                  }
                ],
                "title": "BP-2.01"
              }
            ],
            "id": "BP-2",
            "parts": [
              {
                "id": "BP-2_smt",
                "name": "statement",
                "prose": "Pull requests to protected branches must have a minimum number of approvals"
              }
            ],
            "title": "Require Minimum Approvals"
          },
          {
            "class": "source-code",
            "controls": [
              {
                "id": "BP-3.01",
                "parts": [
                  {
                    "id": "BP-3.01_smt",
                    "name": "statement",
                    "prose": "Force pushes to protected branches must be blocked"
                  },
                  {
                    "id": "BP-3.01_obj",
                    "links": [
                      {
                        "href": "#BP-3.01_smt",
                        "rel": "assessment-for"
                      }
                    ],
                    "name": "assessment-objective"
                  }
                ],
                "title": "BP-3.01"
              }
            ],
            "id": "BP-3",
            "parts": [
              {
                "id": "BP-3_smt",
                "name": "statement",
                "prose": "Force pushes to protected branches must be blocked"
              }
            ],
            "title": "Restrict Force Pushes"
          },
          {
            "class": "source-code",
            "controls": [
              {
                "id": "BP-4.01",
                "parts": [
                  {
                    "id": "BP-4.01_smt",
                    "name": "statement",
                    "prose": "Admin bypass prevention must be enabled on protected branches"
                  },
                  {
                    "id": "BP-4.01_obj",
                    "links": [
                      {
                        "href": "#BP-4.01_smt",
                        "rel": "assessment-for"
                      }
                    ],
                    "name": "assessment-objective"
                  }
                ],
                "title": "BP-4.01"
              }
            ],
            "id": "BP-4",
            "parts": [
              {
                "id": "BP-4_smt",
                "name": "statement",
                "prose": "Admin bypass of branch protection rules must be prevented"
              }
            ],
            "title": "Prevent Admin Bypass"
          },
          {
            "class": "source-code",
            "controls": [
              {
                "id": "BP-5.01",
                "parts": [
                  {
                    "id": "BP-5.01_smt",
                    "name": "statement",
                    "prose": "Code owner review requirements must be enabled"
                  },
                  {
                    "id": "BP-5.01_obj",
                    "links": [
                      {
                        "href": "#BP-5.01_smt",
                        "rel": "assessment-for"
                      }
                    ],
                    "name": "assessment-objective"
                  }
                ],
                "title": "BP-5.01"
              }
            ],
            "id": "BP-5",
            "parts": [
              {
                "id": "BP-5_smt",
                "name": "statement",
                "prose": "Code owner review must be required when CODEOWNERS file exists"
              }
            ],
            "title": "Require Code Owner Review"
          }
        ],
        "id": "source-code",
        "title": "Controls for protecting source code repositories via branch protection rules"
      }
    ],
    "metadata": {
      "last-modified": "2026-07-23T09:37:27.948012504Z",
      "oscal-version": "1.1.3",
      "parties": [
        {
          "name": "ComplyTime",
          "type": "person",
          "uuid": "991df7f4-552d-4966-b700-73b443c11ab0"
        }
      ],
      "responsible-parties": [
        {
          "party-uuids": [
            "991df7f4-552d-4966-b700-73b443c11ab0"
          ],
          "role-id": "author"
        }
      ],
      "roles": [
        {
          "description": "Author and owner of the document",
          "id": "author",
          "title": "Author"
        }
      ],
      "title": "Branch Protection Controls",
      "version": "dev-20260527"
    },
    "uuid": "1f2cd437-2c5d-47bf-bec2-6d84acf79741"
  }
}

Install

Provenance

Source Code Protection

Objective

Assessment requirements

Objective

Assessment requirements

Objective

Assessment requirements

Objective

Assessment requirements

Objective

Assessment requirements