Branch Protection 🔒¶

See also repository.md for repository-wide security settings.

Enforcement 🔒¶

Ruleset Main is Enabled (Enforced)

👉 Meaning for contributors:

Every rule marked ✅ in this document is actively enforced on the default branch (main).
Rules marked ❌ are not part of the ruleset and block nothing.
Contributors MUST comply; violations will block pushes/merges.

Bypass 🚪¶

Organization admins and repository admins can always bypass rules

👉 Meaning for contributors:

Normal contributors MUST follow all rules
Admins MAY merge without approvals or checks

Branch Target 🎯¶

Applies to: main (default branch)

👉 Meaning for contributors:

All rules apply when targeting main.
Feature branches are NOT restricted until a PR targets main.

Restrictions 🚫¶

Restrict Updates ✅¶

Direct pushes are blocked

👉 Contributor impact:

You MUST NOT push directly to main
You MUST use a Pull Request (PR)

Restrict Deletions ✅¶

Protected branch cannot be deleted

👉 Contributor impact:

You MUST NOT delete the main branch

Restrict Creations ❌¶

Branch creation is allowed

👉 Contributor impact:

You MAY create branches freely

Pull Request Requirements 📋¶

Require Pull Request ✅¶

👉 Contributor impact:

You MUST open a PR to merge into main
Direct commits to main are rejected

Required Approvals: 2 ✅¶

👉 Contributor impact:

You MUST get 2 approvals before merging
Self-approval does not count

Dismiss Stale Approvals ✅¶

👉 Contributor impact:

If you push new commits:
- Previous approvals are INVALIDATED
You MUST get approvals again

Require Code Owner Reviews ✅¶

👉 Contributor impact:

If you modify owned files:
- A CODEOWNER MUST approve
PR cannot be merged without them

Require Approval of Most Recent Push ✅¶

👉 Contributor impact:

After your last commit:
- Someone ELSE MUST approve again
You CANNOT approve your own changes

Require Conversation Resolution ✅¶

👉 Contributor impact:

All review comments MUST be resolved
Open discussions block merging

Require Review from Specific Teams ❌¶

👉 Contributor impact:

No fixed team is always required
Only CODEOWNERS matter

Merge Strategy 🔀¶

Allowed Merge Method: Merge ✅¶

👉 Contributor impact:

PRs are merged using merge commits
History MAY become non-linear

Require Linear History ❌¶

👉 Contributor impact:

Merge commits ARE allowed
You MAY see branching history

Require Merge Queue ❌¶

👉 Contributor impact:

PRs can be merged immediately after approval
No automatic queueing

Status Checks (CI/CD) ❌¶

Require Status Checks to Pass ❌¶

👉 Contributor impact:

The ruleset names no required check, so a failing or missing CI run does not block the merge.
CI in your fork still MUST be green before you open the PR, see pull-request.md.

Require Branch to Be Up-To-Date ❌¶

👉 Contributor impact:

The ruleset does not block merging a branch that is behind main.
Your branch still MUST be up to date with main, see pull-request.md.

Security 🔐¶

Require Signed Commits ❌¶

👉 Contributor impact:

The ruleset Main does not reject unsigned commits.
The ruleset Signed, which requires signed commits on main, is disabled.

Block Force Pushes ✅¶

👉 Contributor impact:

You MUST NOT rewrite history on protected branches
git push --force is blocked

Code Scanning 🔬¶

Require Code Scanning Results ✅¶

Configured tools:

CodeQL (High severity)
Hadolint (High severity)

No workflow uploads Hadolint results to code scanning. Hadolint checks Dockerfile as lint-dockerfile inside make lint and writes no SARIF.

👉 Contributor impact:

PR MUST NOT introduce high-severity issues
Otherwise merge is blocked

Code Quality 🏆¶

Require Code Quality Results ✅¶

Threshold: Warnings and higher

👉 Contributor impact:

You MUST fix code quality issues before merge

Copilot Review 🤖¶

Automatically Request Copilot Review ✅¶

👉 Contributor impact:

Copilot may automatically review your PR
It may comment on issues
It does not replace human approvals