Branch protection

Require Foo Guard Security checks before merge to block policy violations.

Overview

Foo Guard publishes the Foo Guard Security GitHub Check on pull requests and default-branch pushes. To block merges when agent configurations violate security policy, require this check in GitHub branch protection or repository rulesets.

Foo Guard does not modify branch protection settings on your behalf. You configure this in GitHub.

Steps (classic branch protection)

1. Open your repository in GitHub → Settings → Branches 2. Add or edit a branch protection rule for your default branch (or target branches) 3. Enable Require status checks to pass before merging 4. Search for and select Foo Guard Security 5. Save the rule

After configuration, pull requests cannot merge while the Foo Guard Security check is failing.

Repository rulesets

If your organization uses rulesets instead of classic branch protection:

1. Go to Settings → Rules → Rulesets 2. Create or edit a ruleset targeting your branches 3. Add a Require status checks rule 4. Select Foo Guard Security 5. Save the ruleset

What causes a failed check

A failed Foo Guard Security check means the scan completed but policy was not met:

Findings at or above the effective failOn severity threshold
Grade below the effective minGrade threshold (when configured)
Baseline regression (when baseline comparison is enabled)

Operational errors (invalid config syntax, scan infrastructure failure) produce a neutral check — not a policy failure.

Verify enforcement

1. Connect the Team GitHub App and enable the repository 2. Add a .fooguard.yml and agent configuration files 3. Open a pull request that introduces a policy violation 4. Confirm Foo Guard Security shows Failed 5. Confirm merge is blocked after branch protection is configured

Pro / CLI alternative

Pro and Team API key holders can enforce policy in GitHub Actions workflows without the Team GitHub App. See CI/CD enforcement and GitHub Action.