GitHub introduces rulesets to block PRs with exposed secrets from merging

Repository rulesets can now be configured to prevent pull requests from merging if they introduce secret scanning alerts. This rule checks that a secret scan has completed for the head commit and that no open alerts exist for secrets introduced by the pull request's commits. By default, it runs on open PRs and blocks secrets found via provider patterns, with options to configure for custom or generic patterns.

This new rule adds protection at the pull request layer, catching secrets that push protection might miss or not be configured to block. While push protection stops secrets at the push, this PR-level rule provides an additional safeguard, allowing for more granular control over different secret types, such as enabling it for generic patterns even if push protection is disabled for them.

The 'Require secret scanning alerts are resolved' rule can be enabled in your repository, organization, or enterprise settings under the Repository > Rulesets tab. It can also be configured programmatically via the REST API using the `require_secret_scanning_alert_resolution` rule type with a `secret_types` parameter, or through GraphQL as `REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION`.