Apply Branch Policy
Check which rulesets are enforced, grade your repositories against the governance checklist, and apply a baseline policy.
Rulesets
Go to Shield → Rulesets to see every organization and repository ruleset GitHub is enforcing right now.
Select a ruleset to check its:
- Enforcement - active, evaluate (dry-run), or disabled
- Rules - decoded into readable terms
- Conditions - which branches and repositories it applies to, including exclusions
- Bypass actors - who can work around it
The Monk CI Shield ruleset created when you activated Shield appears here alongside anything your team configured directly in GitHub.
This page is read-only. Edit rulesets in GitHub - except the baseline policy below, which Shield creates and updates for you.
Posture
Go to Shield → Posture to grade every repository against a nine-control checklist.
| Control | Passes when |
|---|---|
| Pull request required | Direct pushes to the default branch are blocked. |
| Code owner review | Changes require review from designated code owners. |
| Status checks | Required checks must pass before merging. |
| Signed commits | Commits carry a verified signature. |
| Block force push | History cannot be rewritten on the default branch. |
| Block deletion | The default branch cannot be deleted. |
| Linear history | Merge commits are disallowed. |
| Push file restrictions | Limits on file paths and sizes are set. |
| Secret scanning push protection | GitHub blocks pushes containing detected secrets. |
Each control reads pass, fail, or unknown. Unknown means Shield could not determine the setting; it is excluded from the score rather than counted as a pass.
To act on a gap, select a failing control to list the repositories failing it, then apply the baseline policy below.
Baseline Policy
Apply one organization ruleset - Monk CI Baseline Policy - to close a control gap across every repository at once.
Open the drawer
On Posture, select a failing control and click Apply baseline policy.
Set your options
Choose the number of required approvals (up to 10), whether to require code-owner review, and any required status checks.
Choose enforcement
Pick Monitoring to apply the ruleset in dry-run, or Active to enforce it. Start with Monitoring if your repositories have not been checked against these rules before.
Review the preview and apply
Shield shows how many of your scanned repositories already satisfy the baseline. Click Apply baseline policy to create it, or Update baseline policy if it already exists.
The baseline always applies: pull request required, signed commits, force push blocked, branch deletion blocked, and linear history. Required status checks are added only when you specify them.
Two controls the baseline cannot fix
Secret scanning push protection and push file restrictions live outside branch rulesets. Shield marks them as not covered - configure them in your GitHub organization settings.
If Shield reports drift
Drift means someone edited the baseline ruleset in GitHub and removed a managed rule. Shield names the missing rules - re-apply the baseline to restore them.