A GitHub push ruleset rejects a push that contains files you have banned by path, path length, extension or size, before the commits land. It applies to every push, not just selected branches, and covers the repository's whole fork network. It is available only for private and internal repositories.
What a push ruleset can restrict
According to GitHub's documentation, push rules can restrict:
- file paths, with allowed exceptions
- file path length
- file extensions
- file size, with allowed exceptions
They can also sit next to metadata rules that control commit messages and author email addresses.
Useful rules to start with
- Key and certificate extensions. Block extensions such as
.pemand.p12that rarely belong in source control. - Environment files. Block paths such as
.envand similar local configuration files. - Large binaries. Set a size limit so database dumps and build artifacts do not land by accident.
- Sensitive directories. Block a
secrets/path, with an exception for a documented sample folder.
The point is to catch the careless mistake early. A blocked push gives the developer a clear message while the file is still only on their machine.
What they do not catch
Rules match names, sizes and paths. A password inside a file called config.yaml passes, and so does a token pasted into a source file. Pair push rules with secret detection that looks at content. GitHub's push protection and your own scans cover that side. See stopping secrets before they reach Git.
Fork network coverage
Because push rulesets cover the whole fork network, a restriction in the root repository follows forks. For forks, only people with bypass permission in the root repository can bypass the rule. This is useful if your private repository has internal forks for teams.
Rolling it out
Introduce rules with the bypass list set to a small platform team, tell developers where to read the active ruleset (anyone with read access can), and keep a short page explaining each rule and how to request an exception. Track exception requests. A rule that gets bypassed weekly needs a better exception or a better rule.
Large file limits deserve a note of their own. Oversized files bloat every clone for every developer, and once committed they live in history even if a later commit deletes them. A size rule that rejects the push keeps the repository small and spares you a history rewrite later. Choose a limit based on the largest legitimate file you ship today, then allow exceptions by path for the few cases that truly need more, such as a documented test fixture.
Try it yourself
Click through it at your own pace, or open it full screen. Compare an automated gate with the push rules above.
Quick check
Do push rulesets work on public repositories?
GitHub documents them as available only for private and internal repositories.
Will a push rule find a password inside a source file?
No. It matches paths, extensions and sizes, not file contents.
Sources
Last reviewed: 19 October 2026.
