Branch protection for agent-driven repos: everything lands via PR

TL;DR

All changes land through pull requests with review and passing checks. For agent-authored changes, that approver should be a human.

Steps

1. No agent, human, or bot pushes directly to important branches. All changes land through pull requests with review and passing checks. This is the single highest-leverage repo setting for agent-driven development.
2. In the repository settings, protect the main branch and any release branches.
3. Require a pull request before merging, with at least one approving review. For agent-authored changes, that approver should be a human.
4. Require status checks to pass before merging: tests, lint, security scans. An agent PR that breaks the build should not be mergeable by anyone.
5. Turn on dismissal of stale approvals when new commits are pushed, so an approval cannot be reused after the code changed underneath it.
6. Do not exempt administrators or bots from these rules. An exemption is a hole shaped exactly like your automation.
7. - Try pushing to main as a test. It should fail.

• Review the bypass list regularly. Every entry is someone or something that can skip review.

When to use

You are seeing this: No agent, human, or bot pushes directly to important branches. Use this skill when you run into "Branch protection for agent-driven repos: everything lands via PR".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

GitHub's docs describe protected branches: with required reviews enabled, collaborators can only push changes to a protected branch via an approved pull request, and required status checks must pass before merging. Source: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches