Branch protection rules
Repo settings that block direct pushes to main and require reviews plus passing checks before anything can merge.
See it
What it is
Branch protection rules are settings on your host (GitHub rulesets, GitLab protected branches, Bitbucket branch permissions) that say what has to be true before code lands on an important branch. Typical set: no direct pushes, pull request required, at least one approving review, required status checks green, no force push, no branch deletion, and conversations resolved.
Turn them on the day a second person joins the repo, and treat main as the branch that is always deployable. The rules are not about distrust, they are about making the safe path the only path at 5pm on a Friday. Pair them with required status checks so 'reviewed' also means 'tested'.
Gotcha: admin bypass quietly undoes everything. If maintainers can click through the rules, they will, and the protection becomes a suggestion. Enable 'include administrators', and remember rules match by branch name pattern, so protecting 'main' does nothing for 'release/*'. Also give your CI bots and release automation an explicit exception rather than turning the rule off.
Ask AI for it
Set up branch protection for the main branch of this repository. Require pull requests for all changes, at least one approving review with stale approvals dismissed on new commits, all required status checks passing and branches up to date before merge, linear history, and resolved conversations. Block force pushes and branch deletion, and apply the rules to administrators too. Add explicit exceptions only for named release automation. Give me the GitHub ruleset config plus the equivalent gh CLI commands.