GitHub branch protection check should support compensating controls on private repositories using GitHub Free

[filipenevola]

Problem

The GitHub branch_protection evidence check treats missing native branch protection as a failed Change Management control. For private repositories on GitHub Free, the GitHub API returns HTTP 403 because protected branches/rulesets for private repositories require a paid plan.

This makes the automated result depend on purchasing a specific vendor plan rather than evaluating the change-management control objective.

Reproduction

1. Connect a GitHub Free organization containing private repositories.
2. Map the GitHub Branch Protection Enabled check to the Change Management task.
3. Run the check.
4. The check queries repository rules, rulesets, and branch protection.
5. GitHub returns HTTP 403 with the documented plan limitation.
6. The check records a high-severity failure and recommends creating a ruleset requiring a PR and one approval.

No organization names, repository names, IDs, customer data, or credentials are included here.

Expected behavior

• Distinguish not available/not verifiable because of provider plan from verified absence of change control.
• Allow evidence-backed compensating controls for private repositories, such as:
  • pull-request and approval history;
  • CI/test results;
  • deployment-authorization gates;
  • least-privilege write access;
  • direct-push/force-push/deletion detection and alerting;
  • documented exceptions and periodic review.
• Let an assessor review and accept/reject the alternative evidence without the automated branch-protection check forcing the whole task to failed.
• Keep the native branch-protection check as the preferred automatic path when the provider supports it.

Why this matters

SOC 2 defines control objectives; it does not prescribe GitHub or a paid GitHub plan. A platform may recommend preventive branch protection, but organizations using other Git providers, self-hosted systems, GitHub Free private repositories, or compensating detective controls need a truthful review path.

GitHub documents that protected branches and private-repository rulesets require GitHub Pro, Team, or Enterprise, while public repositories can use them on GitHub Free:

• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches
• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets

Suggested outcome

Return a distinct result such as needs_manual_evidence for plan-limited 403 responses, preserve the automated finding, and allow the Change Management task to proceed through manual assessor review with compensating-control evidence.

[linear]

COMP-290