GitHub Code quality

Delete-branch-on-merge disabled

Part of the Repository protection posture check · fix arrives as a guide

What it is

The repository does not delete head branches automatically when a pull request is merged.

Why it matters

Merged branches accumulate until the branch list is mostly dead references, which makes finding live work harder and leaves stale code visible to CI and to search.

The setting, in every form

GitHub can delete a pull request’s branch the moment the PR merges. It is one checkbox — Settings → General → Automatically delete head branches — and the API field behind it is the exact string people search:

# gh CLI
gh repo edit OWNER/REPO --delete-branch-on-merge

# REST API
curl -X PATCH https://api.github.com/repos/OWNER/REPO \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -d '{"delete_branch_on_merge": true}'

Nothing is lost — the part people worry about

Deleting a merged branch deletes a pointer, not commits: the history is in the default branch, the PR keeps its full diff and discussion, and GitHub shows a Restore branch button on the PR page afterwards. Reverting, cherry-picking and blame all keep working. The worry that makes teams hoard branches is aimed at something git already guarantees.

Why stale branches are a real cost

A repo with hundreds of merged-but-alive branches is noise with a security tail: old branches hold pre-fix versions of code with known vulnerabilities, stale configs and the occasional committed secret — all cloneable by anyone with repo access, all still triggering CI in some setups, and all making “which branch is real work?” a genuine question.

Fix it manually

Flip the setting for the future, then clear the backlog once:

# list merged branches (sanity-check before deleting)
git branch -r --merged origin/main | grep -v main

# delete them on the remote
git branch -r --merged origin/main | grep -v main \
  | sed 's|origin/||' | xargs -n1 git push origin --delete

How lumioguard fixes it

The scan reads the repository setting and counts the merged branches still alive. The fix arrives as a guide with the setting, the one-time cleanup above, and the list of branches it would remove — so nothing gets deleted sight unseen.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.

Start for Free View pricing