TECH **Git & GitHub: Protecting Branches (Require Approvals, Status Checks) – Zero-Fluff Study Guide**

Git & GitHub: Protecting Branches (Require Approvals, Status Checks) – Zero-Fluff Study Guide

1. What This Is & Why It Matters

What it is:
Branch protection rules in GitHub let you enforce policies on who can push to a branch, require pull request (PR) approvals, and mandate status checks (like CI tests) before merging. Think of it as a bouncer at a nightclub—only certain people get in, and they must meet the dress code (status checks) and have a VIP pass (approvals).

Why it matters in production:
- Prevents broken deployments: If main is protected, no one can force-push or merge untested code.
- Enforces code review: Requires at least one approval before merging, reducing bugs and security flaws.
- Blocks bad merges: Status checks (e.g., CI tests, security scans) must pass before merging.
- Compliance & audit trails: Mandatory approvals create a paper trail for regulatory requirements (e.g., SOC 2, HIPAA).

Real-world scenario:
You’re a DevOps engineer at a fintech startup. A junior dev accidentally force-pushes to main, breaking the production API. Without branch protection, this could take hours to fix. With protection, GitHub blocks the push and forces a PR with approvals and passing tests.

2. Core Concepts & Components

3. Step-by-Step: Protecting a Branch in GitHub

Prerequisites

• A GitHub repo (public or private).
• Admin or maintainer permissions on the repo.
• A CI workflow (e.g., GitHub Actions) for status checks (optional but recommended).

Task: Protect the main branch with approvals and status checks

Step 1: Navigate to Branch Protection Settings

1. Go to your repo on GitHub.
2. Click Settings → Branches.
3. Under Branch protection rules, click Add rule.
4. In Branch name pattern, enter main (or prod, release/*, etc.).

Step 2: Enable Required Approvals

• Check Require a pull request before merging.
• Check Require approvals and set the number (e.g., 1 for small teams, 2 for critical repos).
• (Optional) Check Dismiss stale pull request approvals when new commits are pushed.

Step 3: Enable Status Checks

• Check Require status checks to pass before merging.
• Under Status checks that are required, select your CI workflow (e.g., ci/tests if you have a GitHub Actions workflow named tests.yml).
• (Optional) Check Require branches to be up to date before merging to prevent merge conflicts.

Step 4: Restrict Who Can Push (Optional)

• Check Restrict who can push to matching branches.
• Add teams/users (e.g., @my-org/devops-team).

Step 5: Save the Rule

• Click Save changes.

Verification

1. Try pushing directly to main:
   bash
git checkout main
echo "test" > test.txt
git add test.txt
git commit -m "Test direct push"
git push origin main
   Expected output:
   ! [remote rejected] main -> main (protected branch hook declined)
error: failed to push some refs to 'github.com/your-repo.git'
2. Create a PR and try merging without approvals:
3. The Merge button will be disabled.
4. Approve the PR and wait for CI to pass:
5. The Merge button will now be enabled.

4. ? Production-Ready Best Practices

Security

• Require signed commits for main/prod branches to prevent impersonation.
• Restrict push access to senior devs/DevOps for critical branches.
• Enable "Include administrators" to prevent even admins from bypassing rules.

Cost Optimization

• Skip status checks for draft PRs (GitHub Actions has a github.event.pull_request.draft condition).
• Use branch protection rules instead of manual reviews to reduce human error.

Reliability & Maintainability

• Enforce linear history (git rebase instead of git merge) for cleaner debugging.
• Use branch naming conventions (e.g., feature/*, hotfix/*) and protect them.
• Tag releases (v1.0.0) and protect tags to prevent accidental deletion.

Observability

• Monitor branch protection violations (GitHub Audit Log).
• Set up alerts for failed status checks (e.g., Slack notifications).

5. ⚠️ Common Mistakes & Traps

6. ? Exam/Certification Focus

Typical Question Patterns

1. "Which setting prevents force-pushes to main?
2. ✅ Branch protection rule with "Restrict force pushes" enabled.

3. ❌ "Git hooks" (not enforced on GitHub).

4. "How do you enforce at least 2 approvals before merging?"

5. ✅ Set "Require approvals" to 2 in branch protection.

6. ❌ "Use CODEOWNERS" (only suggests reviewers, doesn’t enforce count).

7. "What happens if a PR has 1 approval but CI fails?"

8. ✅ Merge button is disabled.
9. ❌ "It merges anyway" (only if status checks are not required).

Key ⚠️ Trap Distinctions

• CODEOWNERS vs. Required Approvals:
• CODEOWNERS suggests reviewers but doesn’t enforce approvals.
• Branch protection enforces approvals.
• Status Checks vs. Required Reviews:
• Status checks = CI tests must pass.
• Required reviews = humans must approve.

7. ? Hands-On Challenge

Challenge:
Protect the dev branch in a repo so that: 1. PRs require 1 approval.
2. CI tests must pass.
3. Only @my-org/dev-team can push to dev.

Solution:
1. Go to Settings → Branches → Add rule.
2. Set Branch name pattern to dev.
3. Enable:
- Require a pull request before merging
- Require approvals (1)
- Require status checks to pass (select your CI workflow)
- Restrict who can push (add @my-org/dev-team) 4. Save.

Why it works:
- GitHub enforces all selected rules before allowing merges.

8. ? Rapid-Reference Crib Sheet

9. ? Where to Go Next

• GitHub Docs: Branch Protection Rules
• GitHub Actions CI Workflow Example
• GitHub CODEOWNERS Guide
• GPG Commit Signing

Final Tip:
Branch protection is your last line of defense against broken deployments. Treat it like a seatbelt—you hope you never need it, but when you do, it saves lives. ?