GitHub can block merges over open secret scanning alerts

GitHub now lets you stop a pull request from merging if it has open secret scanning alerts. A repo can otherwise end up with a merged PR sitting on top of a live credential nobody flagged.

The ruleset, called "Require secret scanning alerts are resolved," entered public preview on September 9 for customers on Secret Protection and Advanced Security, per GitHub's changelog post.

A scan has to complete on the head commit, and no alerts can be open for secrets the PR introduced. That second part matters. Push protection scans for secrets when someone tries to push. It doesn't catch everything. This ruleset is built for what gets through anyway.

Setup runs through three paths: GitHub's rulesets UI, the REST API field require_secret_scanning_alert_resolution, or the equivalent GraphQL enum. That's a normal range of entry points for a security control meant to sit in CI without forcing every team onto the same interface.

What's not in the changelog is what happens to a PR that's mid-review when a scan finishes and finds something. There's no mention of whether the check re-runs automatically once a secret gets rotated and the alert resolved, or whether someone has to manually re-trigger it. For teams running busy merge queues, that gap is worth testing before this becomes a required check on anything high-traffic.