Restrict who can approve pull requests in GitHub

In GitHub, managing who can approve pull requests (PRs) is important for maintaining code quality and ensuring that changes meet project standards before they are merged. This guide explores how to restrict PR approval permissions, using GitHub's branch protection settings.

GitHub PR approval restrictions

Restricting PR approvals helps enforce a higher standard of code review and ensures that only qualified individuals can influence the codebase. This is especially important in environments where code quality and security are paramount.

Step 1: Configure branch protection settings

Branch protection settings in GitHub provide a robust way to control who can approve PRs. These settings can be configured to enforce rules on who can merge changes into protected branches.

1. Navigate to the repository settings: Go to your GitHub repository, click on 'Settings', and then 'Branches'.
2. Add or edit branch protection rules: Select 'Add rule' or edit an existing rule for the branch you want to protect.
3. Enable 'Require pull request reviews before merging': Check this option to enforce PR review.
4. Specify the number of required reviewers: Enter the number of required approvals for PRs.
5. Include administrators: Ensure that the rules apply to everyone, including repository administrators, by checking this option.

Step 2: Limiting PR reviewers

To further control who can approve PRs, you can specify which individuals or teams are authorized to review changes on protected branches.

• Restrict who can dismiss pull request reviews: Specify users or teams who can dismiss review approvals, which is useful for managing changes to PR review statuses.
• Code owner reviews: By using a CODEOWNERS file in your repository, you can define individuals or teams responsible for specific parts of the repository. PRs affecting those parts will require review from the designated code owners.

Step 3: Manage PR reviewer access

Managing access involves configuring who has the ability to approve PRs based on their role within the organization or project.

• Role-based access control: Assign roles to team members within GitHub teams, and use these roles to define who has approval rights.
• GitHub team-based PR approvals: Configure teams in GitHub and assign them as reviewers for specific branches or repositories.

Step 4: Enforcing PR approver rules

Enforcement involves setting up mechanisms to ensure that the approval rules are followed.

• Automate enforcement with GitHub Actions: Set up GitHub Actions to check if the reviewers meet the specified approval policies and automate notifications or rejections if the criteria are not met.

Step 5: Approval policies for pull requests

Define and document your organization’s approval policies to ensure clarity and consistency. This includes specifying:

• Criteria for approval: What constitutes a valid approval? Consider code quality, testing completion, and adherence to project guidelines.
• Fallback procedures: What happens if an authorized approver is unavailable? Define processes for temporary permissions or additional approvers.