HIGH
Source
Trivy
ID
AVD-GIT-0004

GitHub branch protection does not require signed commits.

GitHub branch protection should be set to require signed commits.

You can do this by setting the require_signed_commits attribute to ’true'.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Require signed commits

1
2
3
4
5
6
resource "github_branch_protection" "good_example" {
  repository_id = "example"
  pattern       = "main"

  require_signed_commits = true
}