TMA-GITHUB-1.1.8
Ensure inactive branches are periodically reviewed and removed
説明
Keep track of code branches that are inactive for a lengthy period of time and periodically remove them. Git branches that have been inactive (i.e., no new changes introduced) for a long period of time are enlarging the surface of attack for malicious code injection, sensitive data leaks, and CI pipeline exploitation. Reported as a manual review item: no reliable read-only gh api check exists for this control.
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
For each code repository in use, verify that all existing Git branches are active or have yet to be checked for inactivity by performing the next steps: 1. On GitHub.com, navigate to the main page of the repository. 2. Above the list of files, click Branches. 3. Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first. 4. If the list is empty, you are compliant.
修正方法
修正方法: ガイダンスまたは IaC パッチ
For each code repository in use, review existing Git branches and remove those which have not been active for a period of time by performing the following: 1. On GitHub.com, navigate to the main page of the repository. 2. Above the list of files, click Branches. 3. Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first. 4. For each branch listed, either delete it by clicking the trash bin icon, or find the valid reason it still exists. You can perform the next steps to prevent pull request branches from becoming stale branches: 1.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- githubsource-code
- 参照
- CIS GitHub Benchmark v1.2.0 - 1.1.8 Ensure inactive branches are periodically reviewed and removed