← Back to Branch Protection Drift Check
The ordinary way anyone checks branch protection is opening a repository's
Settings → Branches page and reading the toggles, or running
gh api repos/:owner/:repo/branches/:branch/protection and skimming the JSON.
That confirms a rule is present -- required reviews are on, force pushes are off.
It does not confirm a rule still says what your team agreed it should say. A required review count quietly dropped from 2 to 1 during an incident still reads as "required reviews: on". A required status check left over from a CI job that was renamed six months ago still reads as "status checks: required" -- it just can never be satisfied again, because nothing produces a check with that exact name anymore. Both look identical to a glance and identical in the raw JSON unless you compare every field against a separate, written record of what it should be.
| What you are trying to do | Where to do it |
|---|---|
| Confirm a rule exists at all right now -- is anything protecting this branch. | Settings → Branches, or gh api ... /protection -- this checker does not replace looking at your own settings; it needs you to fetch them first. |
| Change a setting. | Settings → Branches, or the GitHub API -- this checker only compares, it never writes anything back to GitHub. |
| Notice a required review count silently dropped from 2 to 1, or admin enforcement quietly turned off. | This checker -- both still read as "on" at a glance; only a field-by-field diff against a written policy catches the drop. |
| Catch a required status check name left over from a renamed or deleted CI job. | This checker -- the settings page shows the string is required, not whether any job still produces a check with that exact name. |
| Get a written record of what the policy should be, not just what it currently is. | This checker -- typing a policy once (see the field reference on the tool itself) gives you something durable to diff against next time, instead of relying on memory of the last time someone looked. |
| Run the same comparison automatically after every branch-protection or policy change. | This checker's CLI (cli.mjs --fail-on-drift) -- reading the settings page by eye does not scale to "every change, automatically". |
These are not competitors. You still fetch the actual settings from GitHub yourself -- this tool makes no network calls of its own and never reads your branch protection for you. What it replaces is the part eyeballing the settings page cannot do at all: comparing every field against a separate written policy and naming, specifically, which ones no longer match.
For confirming a rule exists at all, yes — open the page, see the toggle, done. This tool answers a different question: does every field still match what your team actually agreed the policy should be? A required review count that was quietly dropped from 2 to 1, or a required status check name left over from a renamed CI job, still shows as "on" in the UI. Reading the page confirms the rule is present; it does not confirm the rule still says what you think it says.
Anything where the field is set but wrong rather than unset. The count under required approving reviews, whether Require approval of the most recent push is on, which named status checks are required (a renamed or deleted CI job leaves a required check nothing can ever satisfy, invisible unless you compare the exact string), and whether admin enforcement is on all look identical to a glance — a settings screen shows their current value, not whether that value still matches a decision your team wrote down somewhere else.
Only informally — a few key: value lines are enough (see the field reference on the tool itself), and you can paste the actual settings first and treat that as your policy draft going forward. The comparison is only as useful as the policy is accurate, the same way reading the settings page is only as useful as your memory of what they should say.
No — you still fetch the actual settings yourself, with gh api repos/:owner/:repo/branches/:branch/protection or the Settings → Branches page, and this tool never reads them for you. It replaces the field-by-field comparison against a written policy, not the act of looking at your repository's settings.