GitLab
Code quality
Releases
Security & compliance
Stability
GitLab project protection
Branch protection, approval gates, and pipeline requirements.
Overview
Reads protected-branch rules, merge-request approval settings, pipeline requirements, and push rules from the live GitLab API, and reports where the default branch can be changed without passing anything.
What it looks for
- Unprotected default branch, or protection that still allows force-push
- Direct developer push to the default branch
- Merges allowed without a passing pipeline
- Secret push protection disabled
Why it matters
Merging without a green pipeline means CI is advisory. An unprotected default branch means the history you deploy from can be rewritten, and secret push protection is what stops a credential reaching the remote at all.
Rules in this check
| What it reports | Fix path |
|---|---|
| Default branch is unprotected | Guide |
| Branch protection too weak | Guide |
| Merge allowed without a passing pipeline | Guide |
| Secret push protection disabled | Guide |
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.