GitHub Flow and protected branches
How most teams use GitHub
GitHub Flow is simple, and used by teams of every size:
mainalways works and can be released at any time- Every change gets a short-lived branch from main
- Push and open a pull request early (a draft PR if it's not ready)
- Automated tests run and a teammate reviews
- Merge into main, delete the branch, release
Protect main
Rules can make GitHub enforce this, so nobody (including you on a bad day) pushes straight to main or force-pushes over it. In your repo: Settings → Rules → Rulesets → New ruleset → New branch ruleset. (Older repos may also show Settings → Branches → Branch protection rules, which does the same job.)
- Target branches: add the default branch (main)
- Restrict deletions and Block force pushes
- Require a pull request before merging, with at least 1 approval
- Require status checks to pass — your GitHub Actions tests (Module 6)
- Set Enforcement status to Active and save
Merge options
| Button | Result on main |
|---|---|
| Create a merge commit | All the branch's commits, plus a merge commit |
| Squash and merge | One commit containing the whole PR — tidy, popular for small PRs |
| Rebase and merge | The branch's commits replayed onto main, no merge commit |
Teams pick one and stick to it (Settings → General → Pull Requests).
Try it
Add a ruleset to your portfolio repo that blocks force pushes and requires a pull request. Then try git push straight to main — what happens?