Branch Protection Rules — The Hotfix That Bypassed All Reviews

Branch protection rules are the most important Git configuration you'll set up. They prevent the most common and most damaging Git mistakes: direct pushes to main, un-reviewed code reaching production, and broken builds being merged. Without protection rules, a single developer error can take down production. With them, every change to main goes through an automated gate. This guide covers the essential protection rules, the incident where a 'hotfix' bypassed all review and broke production, and how to configure branch protection for your workflow.

Configuring Branch Protection on GitHub

GitHub branch protection rules are configured per repository. Go to Settings → Branches → Add rule.

Essential rules for main: - Require PR review before merging: Set to 1 or 2 reviewers. This prevents direct pushes. - Dismiss stale reviews: When new commits are pushed, existing approvals are dismissed, requiring re-review. - Require status checks: Select CI checks that must pass (lint, test, build, security scan). - Require branches to be up to date: The PR branch must be based on the latest main. Prevents conflicts. - Restrict who can push: Only allow specific users/teams or the CI bot. - Allow force pushes: NEVER enable this for main. Set to 'Everyone' or 'Specific actors' only for non-main branches.

Additional security rules: - Require signed commits: Only GPG-signed commits accepted on this branch. - Include administrators: Apply rules to admins too — nobody is above the process.

# Check current branch protection (via GitHub API)
gh api repos/:owner/:repo/branches/main/protection

# Create a branch protection rule (via gh cli)
# Note: gh doesn't have a direct 'protect' command, use API
gh api --method PUT repos/:owner/:repo/branches/main/protection \
  --input - << 'EOF'
{
  "required_status_checks": {
    "strict": true,
    "contexts": ["continuous-integration", "lint", "test"]
  },
  "required_pull_request_reviews": {
    "required_approving_review_count": 1,
    "dismiss_stale_reviews": true
  },
  "enforce_admins": true,
  "restrictions": null
}
EOF

# Apply rule to multiple branches using pattern
echo "main"   # or release/*, develop, etc.

# Remove protection rule
gh api --method DELETE repos/:owner/:repo/branches/main/protection