Read Anthropic’s case study about Graphite Reviewer

Best settings for security reviews in GitHub

Sara Verdi
Sara Verdi
Graphite software engineer
Try Graphite

Security should be a top concern in software development, particularly during the code review phase where vulnerabilities can be spotted and rectified before production deployment. GitHub provides various settings to secure code reviews, ensuring that only authorized changes make it to your main branches. This guide details GitHub’s security review settings and integrates with Graphite Protections to further tighten security protocols.

GitHub offers several settings to enhance the security of code reviews:

Ensuring that all changes pass through a pull request is fundamental. This setting prevents direct pushes to protected branches, requiring changes to be reviewed and approved in a pull request.

Branch protection rules are crucial for securing your codebase:

  • Require code review approvals: Set the minimum number of required review approvals before merging. For high-security repositories, consider requiring two or more approvals.
  • Dismiss stale pull request approvals when new commits are pushed: This ensures that approvals are specific to the latest code version, preventing outdated reviews from affecting security.

The CODEOWNERS file is a GitHub feature that automatically assigns specific individuals or teams to review changes to certain parts of the code. This is particularly useful for sensitive areas of your codebase, such as security configurations or critical infrastructure code.

Require status checks to pass before merging, including:

  • Continuous Integration (CI) tests
  • Security analysis tools
  • Any other checks that validate the security and functionality of the code

Graphite Protections offer advanced control over the mergeability of pull requests, allowing you to tailor security measures for specific needs, beyond what GitHub's settings provide:

Graphite Protections allow setting merge requirements based on file path, programming language, or team, which is particularly useful in monorepos:

  • Require security team approval for sensitive changes: Only allow the security team to approve PRs that affect security-related configurations.
  • Set CI requirements by directory: Minimize the impact of flaky tests by requiring specific CI checks to pass for changes in certain directories.

Graphite Protections integrate seamlessly with GitHub, supporting existing Branch Protection Rules, Rulesets, and CODEOWNERS. When both Graphite and GitHub protections are enabled, they complement each other to ensure all criteria are met before merging.

Graphite also allows for temporary overrides, such as when an on-call engineer needs to make urgent changes, enhancing flexibility without compromising security.

  1. Install the Graphite GitHub app: This is a prerequisite for enabling Protections.
  2. Navigate to the Protections page in Graphite: Use the visual editor to set up and customize your Protections.
  3. Create and manage Protections: Configure the required number of reviews, specific file approvers, and required CI checks for each type of change.

By integrating Graphite Protections with GitHub’s security review settings, organizations can achieve a highly secure and flexible code review process tailored to their specific security needs.

Git inspired
Graphite's CLI and VS Code extension make working with Git effortless.
Learn more

Built for the world's fastest engineering teams, now available for everyone