Question

You administer a GitHub Enterprise Cloud organization that must comply with a new supply-chain integrity policy. Auditors require that every commit merged into the default branch of all repositories be cryptographically verifiable, and that release tags matching 'v*' cannot be deleted or overwritten by anyone except a small release-engineering group. You want to enforce this consistently across all current and future repositories with the least ongoing maintenance. Which approach best meets these requirements?

Accepted Answer

Create an organization-level repository ruleset targeting all repositories with a branch rule requiring signed commits on the default branch and a tag rule for 'v*' that restricts updates/deletions, granting the release-engineering team a bypass

Answer

Enable classic branch protection on the default branch of each repository and manually check the 'Require signed commits' box, then ask developers not to delete release tags

Answer

Configure a required GitHub Actions workflow that verifies commit signatures on pull requests and fails the check if any tag is force-pushed

Answer

Turn on the organization setting to require two-factor authentication and rely on Dependabot to flag any unsigned or tampered commits