Enable branch protection on default branch

[jeremyeder]

Problem

The default branch (main) has no branch protection rules configured. This means anyone with write access can:

• Push directly to main without a pull request
• Force-push to main, potentially rewriting history
• Delete the main branch

Recommended Policy

Enable branch protection on main with at minimum:

• Require a pull request before merging
  • Require at least 1 approval
  • Dismiss stale pull request approvals when new commits are pushed
• Require status checks to pass before merging (if CI is configured)
• Do not allow force pushes
• Do not allow deletions
• Consider: Require signed commits
• Consider: Require linear history
• Consider: Include administrators in these restrictions

How To Enable

1. Go to Settings > Branches > Add branch protection rule
2. Branch name pattern: main
3. Configure the settings above
4. Save changes

References

• GitHub docs: Managing a branch protection rule