# Branch Protection 🔒

See also [repository.md](../repository.md) for repository-wide security settings.

## Enforcement 🔒

* Ruleset is **Enabled (Enforced)**

👉 **Meaning for contributors:**

* All rules in this document are **actively enforced** on the default branch (`main`).
* Contributors MUST comply; violations will block pushes/merges.

---

## Bypass 🚪

* Organization admins and repository admins can always bypass rules

👉 **Meaning for contributors:**

* Normal contributors MUST follow all rules
* Admins MAY merge without approvals or checks

---

## Branch Target 🎯

* Applies to: **`main` (default branch)**

👉 **Meaning for contributors:**

* All rules apply when targeting `main`.
* Feature branches are NOT restricted until a PR targets `main`.

---

## Restrictions 🚫

### Restrict Updates ✅

* Direct pushes are blocked

👉 **Contributor impact:**

* You MUST NOT push directly to `main`
* You MUST use a Pull Request (PR)

---

### Restrict Deletions ✅

* Protected branch cannot be deleted

👉 **Contributor impact:**

* You MUST NOT delete the main branch

---

### Restrict Creations ❌

* Branch creation is allowed

👉 **Contributor impact:**

* You MAY create branches freely

---

## Pull Request Requirements 📋

### Require Pull Request ✅

👉 **Contributor impact:**

* You MUST open a PR to merge into `main`
* Direct commits to `main` are rejected

---

### Required Approvals: 2 ✅

👉 **Contributor impact:**

* You MUST get **2 approvals** before merging
* Self-approval does not count

---

### Dismiss Stale Approvals ✅

👉 **Contributor impact:**

* If you push new commits:

  * Previous approvals are INVALIDATED
* You MUST get approvals again

---

### Require Code Owner Reviews ✅

👉 **Contributor impact:**

* If you modify owned files:

  * A CODEOWNER MUST approve
* PR cannot be merged without them

---

### Require Approval of Most Recent Push ✅

👉 **Contributor impact:**

* After your last commit:

  * Someone ELSE MUST approve again
* You CANNOT approve your own changes

---

### Require Conversation Resolution ✅

👉 **Contributor impact:**

* All review comments MUST be resolved
* Open discussions block merging

---

### Require Review from Specific Teams ❌

👉 **Contributor impact:**

* No fixed team is always required
* Only CODEOWNERS matter

---

## Merge Strategy 🔀

### Allowed Merge Method: Merge ✅

👉 **Contributor impact:**

* PRs are merged using merge commits
* History MAY become non-linear

---

### Require Linear History ❌

👉 **Contributor impact:**

* Merge commits ARE allowed
* You MAY see branching history

---

### Require Merge Queue ❌

👉 **Contributor impact:**

* PRs can be merged immediately after approval
* No automatic queueing

---

## Status Checks (CI/CD) ✅

### Require Status Checks to Pass ✅

👉 **Contributor impact:**

* Your PR MUST pass CI before merging

---

### Required Checks: NONE ⚠️

👉 **Contributor impact:**

* Currently, no checks are enforced
* Effectively: nothing blocks merge here

---

### Require Branch to Be Up-To-Date ✅

👉 **Contributor impact:**

* You MUST update your branch before merging
* Typically via:

  * merge `main`
  * or rebase

---

## Security 🔐

### Require Signed Commits ✅

👉 **Contributor impact:**

* All commits MUST be signed (GPG/SSH)
* Unsigned commits will be rejected

---

### Block Force Pushes ✅

👉 **Contributor impact:**

* You MUST NOT rewrite history on protected branches
* `git push --force` is blocked

---

## Code Scanning 🔬

### Require Code Scanning Results ✅

Configured tools:

* CodeQL (High severity)
* Hadolint (High severity)

👉 **Contributor impact:**

* PR MUST NOT introduce high-severity issues
* Otherwise merge is blocked

---

## Code Quality 🏆

### Require Code Quality Results ✅

* Threshold: Warnings and higher

👉 **Contributor impact:**

* You MUST fix code quality issues before merge

---

## Copilot Review 🤖

### Automatically Request Copilot Review ✅

👉 **Contributor impact:**

* Copilot may automatically review your PR
* It may comment on issues
* It does not replace human approvals