Security engineers have historically relied on developers to follow set security policies through secure coding guidelines and vigilant code review. However, the proliferation of agentic coding has bottlenecked the code review process, and developers are unable to keep up. Now, to help enforce your security policy, Corridor has added the ability to manage a code merge policy for your organization.
Setting and enforcing a merge policy with Corridor
To set a merge policy, head to the Merge Policy tab in Governance. Then choose which finding severities should block a merge as a team-wide standard. After a merge policy is set, Corridor will block any pull request with open findings at those severities, across all your repositories, until they're resolved or explicitly accepted.
Setting a merge policy in Corridor.
The merge policy is enforced by the Corridor CI Check, which shows up as a required status check on the PR. The check passes when there are no open findings at your blocking severities, and fails when there are.
Resolving a blocked pull request
To align a pull request with merge policy, developers can:
- Push a fix so Corridor can automatically re-validate the finding.
- Reply to the Corridor finding in GitHub with "false positive" to dismiss it.
- Reply to the Corridor finding in GitHub with "unblock" to override it.
Reviewing blocked pull requests
In Corridor, the Merge Policy page gives your security team a single view of every pull request currently blocked by policy, so you can see which projects are accumulating blocks, how long each pull request has been waiting, and how many findings are open on it. Filter by severity or project, or open any pull request directly on GitHub.
Reviewing pull requests blocked by merge policy in Corridor.
Use Merge Policy with GitHub today, and watch out for GitLab support in the future. Read our docs to learn more!