computer-playbook/docs/contributing/tools/github/branch/security.md

Branch Protection 🔒

See also repository.md for repository-wide security settings.

Enforcement 🔒

• Ruleset is Enabled (Enforced)

👉 Meaning for contributors:

• All rules in this document are actively enforced on the default branch (main).
• Contributors MUST comply; violations will block pushes/merges.

---

Bypass 🚪

• Organization admins and repository admins can always bypass rules

👉 Meaning for contributors:

• Normal contributors MUST follow all rules
• Admins MAY merge without approvals or checks

---

Branch Target 🎯

• Applies to: main (default branch)

👉 Meaning for contributors:

• All rules apply when targeting main.
• Feature branches are NOT restricted until a PR targets main.

---

Restrictions 🚫

Restrict Updates ✅

• Direct pushes are blocked

👉 Contributor impact:

• You MUST NOT push directly to main
• You MUST use a Pull Request (PR)

---

Restrict Deletions ✅

• Protected branch cannot be deleted

👉 Contributor impact:

• You MUST NOT delete the main branch

---

Restrict Creations ❌

• Branch creation is allowed

👉 Contributor impact:

• You MAY create branches freely

---

Pull Request Requirements 📋

Require Pull Request ✅

👉 Contributor impact:

• You MUST open a PR to merge into main
• Direct commits to main are rejected

---

Required Approvals: 2 ✅

👉 Contributor impact:

• You MUST get 2 approvals before merging
• Self-approval does not count

---

Dismiss Stale Approvals ✅

👉 Contributor impact:

• If you push new commits:

  • Previous approvals are INVALIDATED

• You MUST get approvals again

---

Require Code Owner Reviews ✅

👉 Contributor impact:

• If you modify owned files:

  • A CODEOWNER MUST approve

• PR cannot be merged without them

---

Require Approval of Most Recent Push ✅

👉 Contributor impact:

• After your last commit:

  • Someone ELSE MUST approve again

• You CANNOT approve your own changes

---

Require Conversation Resolution ✅

👉 Contributor impact:

• All review comments MUST be resolved
• Open discussions block merging

---

Require Review from Specific Teams ❌

👉 Contributor impact:

• No fixed team is always required
• Only CODEOWNERS matter

---

Merge Strategy 🔀

Allowed Merge Method: Merge ✅

👉 Contributor impact:

• PRs are merged using merge commits
• History MAY become non-linear

---

Require Linear History ❌

👉 Contributor impact:

• Merge commits ARE allowed
• You MAY see branching history

---

Require Merge Queue ❌

👉 Contributor impact:

• PRs can be merged immediately after approval
• No automatic queueing

---

Status Checks (CI/CD) ✅

Require Status Checks to Pass ✅

👉 Contributor impact:

• Your PR MUST pass CI before merging

---

Required Checks: NONE ⚠️

👉 Contributor impact:

• Currently, no checks are enforced
• Effectively: nothing blocks merge here

---

Require Branch to Be Up-To-Date ✅

👉 Contributor impact:

• You MUST update your branch before merging

• Typically via:

  • merge main
  • or rebase

---

Security 🔐

Require Signed Commits ✅

👉 Contributor impact:

• All commits MUST be signed (GPG/SSH)
• Unsigned commits will be rejected

---

Block Force Pushes ✅

👉 Contributor impact:

• You MUST NOT rewrite history on protected branches
• git push --force is blocked

---

Code Scanning 🔬

Require Code Scanning Results ✅

Configured tools:

• CodeQL (High severity)
• Hadolint (High severity)

👉 Contributor impact:

• PR MUST NOT introduce high-severity issues
• Otherwise merge is blocked

---

Code Quality 🏆

Require Code Quality Results ✅

• Threshold: Warnings and higher

👉 Contributor impact:

• You MUST fix code quality issues before merge

---

Copilot Review 🤖

Automatically Request Copilot Review ✅

👉 Contributor impact:

• Copilot may automatically review your PR
• It may comment on issues
• It does not replace human approvals