Repository Should Not Allow Review Requester To Approve Their Own Request
policy name: repository_allows_review_requester_to_approve_their_own_request
To comply with separation of duties and enforce secure code practices, the repository should prohibit pull request owners from approving their own changes.
Users can merge code without being reviewed which can lead to insecure code reaching the main branch and production.
- Make sure you have admin permissions
- Go to the repo’s settings page
- Enter “Merge Requests” tab
- Under “Approval settings”
- Check “Prevent approval by author”
- Click “Save Changes”