GitHub can now block a pull request from merging while it has open secret scanning alerts
GitHub Changelog·medium signal
A new repository ruleset, "Require secret scanning alerts are resolved," entered public preview on 2026-09-09 for Secret Protection and Advanced Security customers. It checks that a scan completed for the head commit and that no alerts are open for secrets introduced by the PR's commits, catching cases push protection lets through. It is configurable through Repository Rulesets, the REST API field `require_secret_scanning_alert_resolution`, or the GraphQL enum `REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION`.