repo settings protect means no force-push and no delete (internal/policy/access.go:101). With require_approvals 1, require_codeowners on and require_resolved on set on ttorg/widget, an account with write through a team pushed a commit straight to the protected main. The gates apply to mr merge only, so for a team they are advisory.
GitHub, Forgejo and GitLab all have a mode where changes reach a branch through a merge request only. Wants a flag on protect (or a separate setting) under which a direct push to the branch is refused in pre-receive for everyone, with the server's own merge the only writer. Parity row and the Users page.
Ref #185
closed by commit c1d0a3afb0 by cmc: policy, control, web, wiki: require-mr makes protected branches merge-only
2026-09-08 02:35 UTC