Branch protection

Branch protection is a set of rules a Git hosting provider enforces on a branch, usually the default branch, so changes reach it only through an agreed process. The terms below follow GitHub's documentation; GitLab and other providers have their own versions.

What it is

Common settings on a GitHub protection rule:

• Require a pull request with a number of approving reviews, optionally including review from code owners.
• Require status checks to pass, and optionally require the branch to be up to date first.
• Require conversation resolution, signed commits, linear history, or a merge queue.
• Restrict who can push, and block force pushes and deletion. Both are blocked by default.

Admins aren't bound by the rule unless "Do not allow bypassing the above settings" is turned on.

Why it matters

Branch protection is what makes review and CI mandatory rather than polite. Without it, anyone with write access, or an agent using their token, can push straight to the branch you deploy from.

In AI CodeOps

AI CodeOps never pushes a session's change to your default branch. It pushes a branch named codeops/run-<id> and opens a pull request against the target branch, after a person approves the change. When you merge from the console, AI CodeOps runs its own release gate and then calls the provider's normal merge API, with no bypass option, so your protection rules still decide whether the merge goes through.