Source branches kept after merge
Part of the GitLab project posture check · fix arrives as a guide
What it is
The project does not delete source branches when merge requests are merged.
Why it matters
Merged branches accumulate indefinitely, making the branch list hard to navigate and leaving superseded code where it can still be checked out or referenced by mistake.
What the checkbox means
“Delete source branch when merge request is accepted” — the option on every merge request — deletes the *source* branch (the feature branch) after the merge completes. The *target* branch and every merged commit are untouched: the work is already in the target, the MR keeps its diff and discussion, and the commits stay reachable forever. The checkbox deletes a pointer whose job is done.
Make it the default instead of a per-MR habit
Relying on each author to tick the box produces exactly the branch pile this check finds. Set it at the project level:
Settings → Merge requests
☑ Enable "Delete source branch" option by defaultAuthors can still untick it for the rare branch that outlives its MR — long-running release branches, stacked work — which is the right polarity: keeping a branch becomes the deliberate act, not deleting one.
Why the pile matters
Dozens of merged-but-alive branches make the branch list useless for finding real work, keep pre-fix code with known vulnerabilities cloneable, and occasionally preserve a secret that was committed early on a feature branch and cleaned up before merge — the branch keeps the dirty history alive.
Clear the backlog once
# list remote branches fully merged into the default branch
git branch -r --merged origin/main | grep -vE 'main|master'
# delete them
git branch -r --merged origin/main | grep -vE 'main|master' \
| sed 's|origin/||' | xargs -n1 git push origin --deleteHow lumioguard fixes it
The scan reads the project setting and counts merged branches still alive. The fix arrives as a guide: the setting, the cleanup above, and the branch list it would remove — reviewed before anything is deleted.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.