GitHub settings hardening checklist

[karlwaldman]

Generated from a GitHub settings audit on 2026-07-16.

Use this as a working checklist. If this repository is no longer maintained, archive it and close this issue instead of applying every hardening item.

Branch And Merge Controls

• Protect main with a branch rule or ruleset: require pull requests, passing CI checks when available, conversation resolution, and block force pushes/deletions.
• For production/customer-facing repos, apply branch/ruleset requirements to admins as well as normal collaborators.

Security Scanning

• Enable secret scanning where supported by the repository plan and visibility.
• Enable secret scanning push protection where supported so detected secrets are blocked before reaching the repo.
• Evaluate CodeQL/default code scanning for this repo if it contains application, SDK, infrastructure, or workflow code.

GitHub Actions

• For repos with workflows, restrict Actions to trusted actions or require third-party actions/workflows to be pinned to full commit SHAs.

Repository Hygiene

• Disable the wiki if it is unused; keep docs in versioned files when possible.

Verification

• Confirm main branch settings in Settings > Branches or Rulesets.
• Confirm Settings > Code security and analysis reflects the intended Dependabot, secret scanning, and push protection settings.
• Confirm Settings > Actions > General uses the intended workflow permissions and action policy.

Audit Notes

• Default branch main is currently unprotected.
• Security settings: Dependabot alerts=enabled, Dependabot security updates=enabled, secret scanning=disabled, push protection=disabled, code security=missing.
• Actions workflow permissions: default=read, can_approve_prs=False.
• Actions policy: enabled=True, allowed_actions=all.
• Repo hygiene: delete_branch_on_merge=True, allow_forking=True, wiki=True, license=present.