Question

A developer at your company is trying to push a commit that contains a test configuration file. Push protection for secret scanning is enabled organization-wide. The push is blocked because GitHub detected what appears to be an AWS access key ID, but the developer insists it is a fabricated, non-functional value used only for unit tests. The developer needs to complete the push, and your security team requires that all such bypasses be reviewable after the fact. As the enterprise administrator, what is the correct guidance?

Accepted Answer

Instruct the developer to bypass the block by selecting a reason (such as 'It's used in tests') when prompted, which records the bypass in the audit log for the security team to review.

Answer

Disable push protection for the entire organization so the developer can push, then re-enable it after the commit lands.

Answer

Tell the developer to delete their local branch and re-clone the repository, since push protection only triggers on branches with prior alerts.

Answer

Add the developer to a repository admin role, because only repository admins are subject to push protection enforcement.