Branch protection
Branch protection applies repository rules to specified branches, such as requiring reviews or status checks and restricting direct pushes, force pushes, or deletion.
A branch protection rule can require reviews and status checks before changes reach a branch, and restrict force pushes or deletion. The name of the feature tells you less than the rule that is actually enabled.
On GitHub, a rule can cover a named branch or a name pattern. By default, administrators and roles with bypass permission are exempt from its restrictions; applying those restrictions to them is a configuration choice. A review of the rule should include those exceptions.
Does approval cover the latest change?
GitHub can dismiss stale approvals when new commits change a pull request’s diff. It can also require approval of the most recent reviewable push by someone other than the person who pushed it. These settings address a practical problem: a reviewer may have approved an earlier version, before more code was added.
CODEOWNERS identifies reviewers for particular files. Branch protection makes their approval a merge requirement when configured to do so. The maintainer handoff article explains how this differs from simply giving someone repository write access.
Merging and running code are separate decisions
A pull request may trigger automation before anyone merges it. Branch protection does not replace controls on the runner’s credentials or access. The workflow approval guide covers that execution risk.