GitHub
TMA-GITHUB-1.1.8
Ensure inactive branches are periodically reviewed and removed
Descrição
Keep track of code branches that are inactive for a lengthy period of time and periodically remove them. Git branches that have been inactive (i.e., no new changes introduced) for a long period of time are enlarging the surface of attack for malicious code injection, sensitive data leaks, and CI pipeline exploitation. Reported as a manual review item: no reliable read-only gh api check exists for this control.
Como é verificado
Método de auditoria: Revisão manual
For each code repository in use, verify that all existing Git branches are active or have yet to be checked for inactivity by performing the next steps: 1. On GitHub.com, navigate to the main page of the repository. 2. Above the list of files, click Branches. 3. Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first. 4. If the list is empty, you are compliant.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
For each code repository in use, review existing Git branches and remove those which have not been active for a period of time by performing the following: 1. On GitHub.com, navigate to the main page of the repository. 2. Above the list of files, click Branches. 3. Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first. 4. For each branch listed, either delete it by clicking the trash bin icon, or find the valid reason it still exists. You can perform the next steps to prevent pull request branches from becoming stale branches: 1.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- githubsource-code
- Referência
- CIS GitHub Benchmark v1.2.0 - 1.1.8 Ensure inactive branches are periodically reviewed and removed