https://www.cloudkaramchari.com/tags/repository-rulesets/Recent content in Repository Rulesets on CloudkaramchariHugo -- gohugo.ioencloudkaramchariWed, 16 Sep 2026 14:00:00 +0530https://www.cloudkaramchari.com/blog/block-github-pull-requests-with-exposed-secrets-ruleset-guide/Wed, 16 Sep 2026 14:00:00 +0530https://www.cloudkaramchari.com/blog/block-github-pull-requests-with-exposed-secrets-ruleset-guide/ <h1 id="block-github-pull-requests-with-exposed-secrets-new-ruleset-rule-setup-guide">Block GitHub Pull Requests With Exposed Secrets: New Ruleset Rule Setup Guide</h1> <p>Push protection catches a lot of leaked secrets, but it has always had a gap: it only inspects the commits in a single <code>git push</code>. A secret that slipped in through a squash-merged branch, a force-push that bypassed protection, a fork PR from a contributor without push protection enabled locally, or a commit made before secret scanning was turned on can still land on <code>main</code> with an open alert nobody resolved. As of September 9, 2026, GitHub closed that gap at the merge layer: repository rulesets now support a rule called <strong>&quot;Require secret scanning alerts are resolved&quot;</strong> that blocks a pull request from merging at all while it has unresolved secret scanning alerts.</p>