GitHub added a pull-request merge protection rule on September 9 for repositories using Secret Protection or GitHub Advanced Security. When enabled, the rule stops a pull request from merging if its commits introduce secret-scanning alerts that have not been resolved. The feature is in public preview.
The check requires a completed secret scan for the pull request's head commit and no open alerts for newly introduced credentials. By default, it looks for provider-defined secret patterns. Teams can extend the rule to cover custom or generic patterns and can apply it through repository, organization, or enterprise rulesets.
This happens later than push protection. Push protection tries to prevent a leaked token from entering Git history in the first place. The new rule can stop the merge even when a push was allowed, but the secret may already be present in the branch and still needs proper remediation. A user with configured bypass permissions may also be allowed to proceed.
GitHub documents the configuration under repository Rulesets, where administrators select the rule requiring pull-request secret-scanning alerts to be resolved.