GitHub Branch Protection

Stop accidental pushes to the default branch and require review or checks before history can move.

Protection is GitHub, not Git

Git Branching Workflow wrote a contract: short-lived branches return through pull requests. A contract that nobody enforces is a README. GitHub branch protection (a branch ruleset, or a classic protection rule) is GitHub refusing to move a hosted branch unless the rule is satisfied. It is not a Git command. There is no git protect.

# These are Git. None of them is GitHub branch protection.
git switch main
git push origin main
git branch --list

Use a disposable GitHub repository you own. Do not edit protection on a project you do not maintain. Do not lock the original main of a fork you just created.

Require a pull request, not a lockout

On GitHub: Settings → Rules → Rulesets (or the older Settings → Branches classic rule). Target the default branch, usually main. The job for this lesson is one switch with a clear meaning.

Rulesets and classic branch protection are both GitHub. If the UI offers a ruleset, use it. The proof is the same: git push origin main is rejected, and a pull request still merges.

Prove origin refuses a direct push

After the rule targets main, do not guess. Make a local commit on main and push. GitHub should refuse. Read the error. That refusal is the lesson, not a broken remote.

# On a clone of a GitHub repository YOU own, after protection
# requires a pull request before merging into main.
git switch main
git pull origin main

# A tiny local commit on main is still legal Git.
# GitHub can still refuse to move origin/main.
echo "protection probe" >> PROTECTION.md
git add PROTECTION.md
git commit -m "Probe a direct push to protected main"
git push origin main

Local main now has a commit origin/main does not. That is the same “ahead” state Git Remote taught. The difference is GitHub’s policy, not a new Git object.

Recover through a pull request

Do not force-push. Do not turn the rule off to sneak the commit through. Move the probe onto a feature branch, reset local main to origin/main, and open a pull request. That is the path protection is there to keep.

# Leave the probe commit on a feature branch instead of fighting main.
git switch -c feature/protection-probe
git push -u origin feature/protection-probe
git switch main
git reset --hard origin/main

gh pr create --base main --title "Add protection probe note" --body "$(cat <<'EOF'
## Summary
Proves the default branch refuses a direct push and still accepts a pull request.

## How to verify
1. Confirm git push origin main is rejected while this rule is on.
2. Confirm this pull request can still merge.
EOF
)"

git reset --hard origin/main on local main is safe here only because the probe commit is already on feature/protection-probe. If you reset first, you can lose the commit. Match the order above. Then merge the pull request the way GitHub Code Review already taught.

CODEOWNERS is GitHub, stored in Git

A CODEOWNERS file is an ordinary path in the repository. Git records it. GitHub reads it on the default branch to suggest or require reviewers for matching paths. Put it at .github/CODEOWNERS so a stranger can find it.

# .github/CODEOWNERS on the default branch
# Replace with YOUR GitHub username. This is not a Git command.
* @YOUR_GITHUB_USERNAME
README.md @YOUR_GITHUB_USERNAME

Replace YOUR_GITHUB_USERNAME with the account that owns the practice remote. A made-up handle is a GitHub error, not a Git error. Requiring a review from listed owners is a separate protection checkbox. On a solo repo, add the file and leave that requirement off so you can still merge.

Inspect the rule

# From the same clone, after a rule targets main
gh api repos/{owner}/{repo}/branches/main/protection
git ls-remote origin
git branch -vv

gh api repos/{owner}/{repo}/branches/main/protection talks to GitHub. If you created a classic rule, you should see JSON that mentions pull requests or reviews. A 404 can mean there is no classic rule—rulesets live at a different API. In that case, confirm the ruleset in Settings and keep the rejected-push proof; do not pretend Git stored the policy.

git ls-remote origin still only lists refs. It will not print protection. That is the Git versus GitHub split again.

What not to enable yet

Guided practice: protect main

1. 01
   Pick a repository you own

   Confirm git remote -v is your GitHub URL. Update local main.

2. 02
   Add a rule on main

   Require a pull request before merging. Block force pushes. Do not require extra approvals or status checks. Do not enforce the rule on administrators.

3. 03
   Prove the rejection

   Commit on local main and run git push origin main. Save the error text.

4. 04
   Land it through a pull request

   Move the commit to feature/protection-probe, reset local main to origin/main, open and merge the pull request.

5. 05
   Add CODEOWNERS

   Commit .github/CODEOWNERS with your username, through another short-lived branch. Inspect with gh api or the Settings page.

Independent lab: branch protection

1. On a GitHub repository you own, add a ruleset or classic rule that requires a pull request before merging into main. Do not require two reviewers. Do not require a status check. Do not lock administrators out.
2. Make a local commit on main and run git push origin main. Record that GitHub refused. Do not force-push. Do not turn the rule off to sneak the commit through.
3. Move the work onto a feature branch, reset local main to origin/main, open a pull request, and merge it.
4. Add .github/CODEOWNERS naming your GitHub username. Show gh api repos/{owner}/{repo}/branches/main/protection or a screenshot of the ruleset, plus the rejected-push error.
5. Write six lines: repository URL, which GitHub setting you enabled, the rejected command, how the change still landed, the CODEOWNERS path, and one sentence that distinguishes GitHub protection from git push. Do not change protection on a project you do not maintain.

Common protection mistakes

Lesson review

You can protect main on GitHub so a direct push is refused, keep a pull-request path open, and store CODEOWNERS in Git for GitHub to read. Repeatable issue and pull request shape is GitHub Collaboration. Required status checks are GitHub Actions.

• I know GitHub branch protection is not a Git command and not a Git object.
• I can require a pull request on main without locking a one-person repo or inventing a status check.
• I can prove git push origin main is refused, then land the same commit through a pull request.
• I can add .github/CODEOWNERS and inspect the rule with gh api or Settings, on a repository I own.