Branch protection and review policies
MS Learn module: Branch protection and review policies · Learning objectives: protect the main/trunk branch so no change merges without an approved, policy-satisfying pull request that has passed CI.
Overview
The main branch is the integrity boundary of the project — code merged there is what builds and ships. Branch protection enforces that boundary: no direct pushes to main, only PRs that pass required CI checks and required human reviews may land. It is defense-in-depth before the pipeline even runs.
Units / lessons covered
- Protecting main (trunk) — make main non-writable; only merged pull requests can update it.
- Required reviewers — a PR needs an approval from a chosen/user-reviewer before it can be merged.
- Required status checks — merged gate also demands the CI/validation rules be green before the merge button is offered.
- Rule scope & terminology — branch protection rules (GitHub) vs Azure DevOps branch policies, name patterns, who may push/merge, enforced rules.
Concepts introduced (link to term notes)
- azure-repos
- ci-trigger — CI validation as a gate the PR must pass
- pipeline-security
- branching-strategy
Key terms / commands
- GitHub: branch protection rules, required approving reviews, required status checks, dismiss stale pull requests, require signed commits / linear history.
- Azure DevOps: branch protection rules, required reviewers, and enforced permissions on the branch. Terminology differs by provider, but the model is the same — nobody writes to main directly.
Hands-on / what to try
Open a test repo, make main protected and non-writable, open a PR, confirm merge is blocked without an approval, then enable a required CI status check and confirm the merge is also blocked until CI is green.
Exam focus
- Branch protection is a pre-pipeline control: required reviewers + status checks gate the code before CI can even run on a merged change.
- Protecting main is the primary defense against untrusted, un-reviewed, or failing changes.
- Distinguish required reviewers (human approval) from required status checks (CI automation) — both are frequently tested.
Related
Path MOC · pipeline-security-controls · dependency-and-supply-chain