3 ms·

You can set up your repo to disable pushing directly to branches like main and require MFA to use the org admin account, so something malicious would need to pu

by benoau 11mo ago

You can set up your repo to disable pushing directly to branches like main and require MFA to use the org admin account, so something malicious would need to push to a benign branch and separately be merged into one that deploys come from.

sallveburrpi 11mo ago
Pushing directly to main seems crazy - for anything that is remotely important I would use a pull request/merge request pattern
- esseph 11mo ago
  Depends on the use case of the repo.
- otterley 11mo ago
  There's nothing wrong with pushing to main, as long as you don't blindly treat the head of the main branch as production-ready. It's a branch like any other; Git doesn't care what its name is.
  - sallveburrpi 10mo ago
    Yea ofc I was implying that main is the branch that is pushed to production.
t0mas88 11mo ago
But the attacker could just create a branch, merge request and then merge that?
- x0x0 11mo ago
  We require review on PRs before they can be merged.
- benoau 11mo ago
  They can't with git by itself, but if you're also signed in to GitHub or BitBucket's CLI with an account able to approve merges they could use those tools.