Restrict who can approve pull requests in GitHub

In GitHub, managing who can approve pull requests (PRs) is important for maintaining code quality and ensuring that changes meet project standards before they are merged. This guide explores how to restrict PR approval permissions, using GitHub's branch protection settings and other tools like Graphite Protections to enforce approval policies.

GitHub PR approval restrictions

Restricting PR approvals helps enforce a higher standard of code review and ensures that only qualified individuals can influence the codebase. This is especially important in environments where code quality and security are paramount.

Step 1: Configure branch protection settings

Branch protection settings in GitHub provide a robust way to control who can approve PRs. These settings can be configured to enforce rules on who can merge changes into protected branches.

1. Navigate to the repository settings: Go to your GitHub repository, click on 'Settings', and then 'Branches'.
2. Add or edit branch protection rules: Select 'Add rule' or edit an existing rule for the branch you want to protect.
3. Enable 'Require pull request reviews before merging': Check this option to enforce PR review.
4. Specify the number of required reviewers: Enter the number of required approvals for PRs.
5. Include administrators: Ensure that the rules apply to everyone, including repository administrators, by checking this option.

Step 2: Limiting PR reviewers

To further control who can approve PRs, you can specify which individuals or teams are authorized to review changes on protected branches.

• Restrict who can dismiss pull request reviews: Specify users or teams who can dismiss review approvals, which is useful for managing changes to PR review statuses.
• Code owner reviews: By using a CODEOWNERS file in your repository, you can define individuals or teams responsible for specific parts of the repository. PRs affecting those parts will require review from the designated code owners.

Step 3: Manage PR reviewer access

Managing access involves configuring who has the ability to approve PRs based on their role within the organization or project.

• Role-based access control: Assign roles to team members within GitHub teams, and use these roles to define who has approval rights.
• GitHub team-based PR approvals: Configure teams in GitHub and assign them as reviewers for specific branches or repositories.

Step 4: Enforcing PR approver rules

Enforcement involves setting up mechanisms to ensure that the approval rules are followed.

• Automate enforcement with GitHub Actions: Set up GitHub Actions to check if the reviewers meet the specified approval policies and automate notifications or rejections if the criteria are not met.
• Integration with external tools: Integrate with third-party tools like Graphite Protections for more sophisticated governance and compliance checks.

Step 5: Approval policies for pull requests

Define and document your organization’s approval policies to ensure clarity and consistency. This includes specifying:

• Criteria for approval: What constitutes a valid approval? Consider code quality, testing completion, and adherence to project guidelines.
• Fallback procedures: What happens if an authorized approver is unavailable? Define processes for temporary permissions or additional approvers.

To restrict who can approve pull requests in GitHub using Graphite Protections, you follow these steps, which harness the fine-grained control that Graphite offers:

How to set up approval restrictions using Graphite Protections

1. Install the Graphite GitHub app in your org: Ensure that the Graphite GitHub app is installed and configured for your repository.

2. Access Graphite Protections: Navigate to the Protections page in your Graphite dashboard. This page allows you to define and manage your custom protection rules.

3. Define approval rules:

   • By team or role: You can specify that only members of certain teams or with specific roles are authorized to approve pull requests. For example, only security team members can approve changes to security configurations.
   • By file path: Set up rules that require approvals from domain experts for changes to specific directories or files. This ensures that the right experts review changes to critical parts of your codebase.
   • Conditional approvals: Implement conditions where approvals from certain individuals are required only under specific circumstances, such as high-risk changes.

4. Implement overrides: Graphite allows you to define exceptions to general rules, which can be useful in scenarios like urgent hotfixes or when a key reviewer is unavailable.

5. Monitor and adjust: After setting up the rules, monitor their impact on your workflow and make adjustments as necessary to balance security with development efficiency.

Benefits over vanilla GitHub access controls

Using Graphite Protections offers several benefits over the standard GitHub access controls:

• Enhanced flexibility: Unlike GitHub, which restricts rules to branch levels, Graphite allows for dynamic and granular control at the PR level. This means you can tailor the approval process based on the content of the PR rather than just the branch it targets.

• Reduced overheads: Graphite Protections eliminate the need for maintaining custom scripts or extensive GitHub Actions setups, which can be labor-intensive and prone to errors.

• Scalability and compliance: As teams grow and projects become more complex, Graphite's approach supports scalability and compliance without adding administrative burden. It provides a framework that grows with your team and adapts easily to new workflows or organizational changes.

• Specificity and security: By allowing more specific rules, Graphite helps in maintaining a higher security posture. You can ensure that only the most qualified individuals can approve sensitive changes, reducing the likelihood of errors or security breaches.

Graphite Protections thus provide a powerful, customizable toolset for managing pull request approvals in a way that aligns with modern development practices and complex project needs. Try out Graphite Protections today for free!