Skip to content

MAIN_BRANCH_PROTECTION.md

Latest commit

 

History

History
27 lines (20 loc) · 1.5 KB

MAIN_BRANCH_PROTECTION.md

File metadata and controls

27 lines (20 loc) · 1.5 KB
Raw

Protecting main

The goal is simple: contributors should be able to fork/open PRs, but only the repository owner should be able to update or merge into main.

For a public personal-account repository, use a repository ruleset targeting the default branch.

Recommended GitHub settings:

  1. Open Settings -> Rules -> Rulesets.
  2. Create a New branch ruleset named protect-main.
  3. Set enforcement to Active.
  4. Target the default branch / main.
  5. Add these rules:
    • Restrict updates
    • Restrict deletions
    • Block force pushes
    • Require a pull request before merging
    • Require status checks to pass before merging
  6. Add required status check: the validation workflow/check produced by .github/workflows/validate.yml after it has run once.
  7. Configure bypass so only the repository-administrator role can bypass/update the branch. On a personal repository, the owner is the administrator; ordinary collaborators are not.
  8. Keep CODEOWNERS enabled in this repository and, if GitHub offers the option in your plan/ruleset UI, require code-owner review for core changes.

With Restrict updates, merging a PR is also an update to main, so contributors cannot merge their own PRs. They can still create branches/forks and submit PRs for owner review.

Do not give contributors administrator access if you want this guarantee.

The GitHub connector used to build this project cannot create repository rulesets on your behalf. Apply this ruleset in GitHub after the repository is created.