Application Changes Reviewed Test (GitHub)

Jake Samuels
Jake Samuels Vanta Expert Vanta Team Member
  • Updated

This test ensures that pull requests are reviewed prior to getting merged into the branch used for your application. This article explains how to set this up properly for GitHub.

To set this up properly for Vanta to recognize, follow these steps:

1. Navigate to the Settings tab of the repository you would like to implement this for

2. Select the Branches option under the Code and automation section

3. Select Edit for the branch you would like to make this change for. To see which branch Vanta is looking at for this test, see the "Troubleshooting" section of this article below


4. Ensure that Require a pull request before merging is checked

5. Check Require approvals

6. Ensure the Required number of approvals before merging is set to 1 or greaterProtectBranch.png


To determine which branch Vanta is looking at for this test, you will want to check if you've set the "vanta_production_branch_name" custom property at the organization level. This was optional when setting up the integration initially:


To check this in GitHub, follow these steps

1. Navigate to the settings page for your organization

2. Select the Custom properties option under the Repository category:VantaProdBranchGithub.png

If a custom property is set, Vanta will be exclusively looking at that branch for the required approvals. While there is a default value that is set at creation of this property, you can update the property per repository by selecting Set values. If you would rather have Vanta look at the default branch for these repositories, you can delete the Custom property entirely and Vanta will look at the Default branch.

You can also see which branches Vanta is looking at by exporting test data for the test by selecting More>Export Test Data on the top right of the test page in Vanta:AppChangesTestData.png

If a productionBranch is listed for the repository, Vanta is only looking at this branch for the test. Removing the custom property in GitHub will allow the test to only look at the defaultBranch value.