Secure repo governance — SG k1
A compact, operational approach for GitHub Desktop environments: policies, enforced controls, audit checkpoints and rollout guidance tailored for Singapore teams.
Core principles
Least privilege
Grant minimum access by role and enforce via teams and repository permissions.
Auditability
Structured logs, branch protection events, and periodic audit reviews.
Operational clarity
Clear owner assignments and documented exception paths for incident response.
Mandatory controls
Recommended baseline for production repositories.
Enforce branch protection on main branches: require pull request reviews from at least one approver, enable status checks, disallow force pushes and deletions.
Enable secret scanning and block pushes with detected secrets. Integrate with centralized secrets store for CI/CD and deprecate inline credentials.
Use SSO for org access, synchronize team membership from your identity provider, and apply quarterly access reviews for privileged roles.
Implementation pattern
- Inventory repos and tag sensitivity level.
- Apply protection templates and enforce via admin policies.
- Run a dry-run scanner and address findings.
- Publish repo-level README with maintenance and owner contacts.
Operational checklist
| Setting | Recommended value | Why |
|---|---|---|
| Branch protection | Enabled; require PR reviews; reset approvals on push | Prevents direct commits and enforces review |
| Enforce SSO | Required for org members | Centralized identity and offboarding |
| Secret scanning | Enabled; block pushes | Reduce credential exposure |
| Dependabot | Enabled for security updates | Automated patching of dependencies |
| Default branch protection on templates | Apply via org policy | Consistency across repos |
Case snippets & learnings
Training & rollout
Run a staged rollout: pilot teams → infra repos → product repos. Provide a short checklist and one-hour workshop for reviewers.
- Pre-flight checklist for maintainers
- Automated reporters for policy drift
Resources
Need a tailored policy or onboarding support? Contact our advisory team.
Request advisory