Block pull requests with exposed secrets from merging
The public preview rule adds a merge-time check alongside push protection, for customers with GitHub Secret Protection or Advanced Security.
Pull requests that introduce exposed secrets can now be blocked from merging. GitHub's new repository ruleset rule, require secret scanning alerts are resolved, stops a pull request from merging until every secret scanning alert it introduces is resolved.
The rule checks two things before allowing a merge: that a secret scan has completed on the head commit, and that no alerts remain open for secrets introduced by the pull request's commits. Developers without bypass permissions have to resolve each alert to clear the block. By default it only blocks secrets found via provider patterns, but it can be configured to also cover custom or generic patterns.
It's a separate layer from push protection, which stops a secret at the point it's pushed. This rule catches cases push protection isn't set up to catch, such as generic pattern secrets when push protection for that category is turned off. It's available today in public preview for customers with GitHub Secret Protection or GitHub Advanced Security.
