|
| 1 | +# Branch Protection Configuration |
| 2 | + |
| 3 | +Configure these settings in **GitHub Repository Settings → Branches → Branch protection rules**. |
| 4 | + |
| 5 | +## `develop` Branch Protection |
| 6 | + |
| 7 | +1. Go to: Settings → Branches → Add rule |
| 8 | +2. Branch name pattern: `develop` |
| 9 | +3. Configure: |
| 10 | + |
| 11 | +``` |
| 12 | +✅ Require a pull request before merging |
| 13 | + ✅ Require approvals: 1 |
| 14 | + ✅ Dismiss stale pull request approvals when new commits are pushed |
| 15 | + ✅ Require approval of the most recent reviewable push |
| 16 | +
|
| 17 | +✅ Require status checks to pass before merging |
| 18 | + ✅ Require branches to be up to date before merging |
| 19 | + Status checks: |
| 20 | + - test (Node.js 18.x) |
| 21 | + - test (Node.js 20.x) |
| 22 | + - test (Node.js 22.x) |
| 23 | + - coverage |
| 24 | +
|
| 25 | +✅ Require conversation resolution before merging |
| 26 | +
|
| 27 | +✅ Include administrators |
| 28 | +
|
| 29 | +❌ Allow force pushes (disabled) |
| 30 | +❌ Allow deletions (disabled) |
| 31 | +``` |
| 32 | + |
| 33 | +**Deployment:** ❌ No automatic deployment (CI only) |
| 34 | + |
| 35 | +--- |
| 36 | + |
| 37 | +## `staging` Branch Protection |
| 38 | + |
| 39 | +1. Go to: Settings → Branches → Add rule |
| 40 | +2. Branch name pattern: `staging` |
| 41 | +3. Configure: |
| 42 | + |
| 43 | +``` |
| 44 | +✅ Require a pull request before merging |
| 45 | + ✅ Require approvals: 1 |
| 46 | + ✅ Dismiss stale pull request approvals when new commits are pushed |
| 47 | + ✅ Require approval of the most recent reviewable push |
| 48 | +
|
| 49 | +✅ Require status checks to pass before merging |
| 50 | + ✅ Require branches to be up to date before merging |
| 51 | + Status checks: |
| 52 | + - test (Node.js 18.x) |
| 53 | + - test (Node.js 20.x) |
| 54 | + - test (Node.js 22.x) |
| 55 | + - coverage |
| 56 | +
|
| 57 | +✅ Require conversation resolution before merging |
| 58 | +
|
| 59 | +✅ Restrict who can push to matching branches (optional) |
| 60 | + Allowed: develop branch only |
| 61 | +
|
| 62 | +✅ Include administrators |
| 63 | +
|
| 64 | +❌ Allow force pushes (disabled) |
| 65 | +❌ Allow deletions (disabled) |
| 66 | +``` |
| 67 | + |
| 68 | +**Deployment:** ✅ Auto-deploy to Staging environment |
| 69 | + |
| 70 | +--- |
| 71 | + |
| 72 | +## `main` Branch Protection |
| 73 | + |
| 74 | +1. Go to: Settings → Branches → Add rule |
| 75 | +2. Branch name pattern: `main` |
| 76 | +3. Configure: |
| 77 | + |
| 78 | +``` |
| 79 | +✅ Require a pull request before merging |
| 80 | + ✅ Require approvals: 2 (WICHTIG: 2 Approver!) |
| 81 | + ✅ Dismiss stale pull request approvals when new commits are pushed |
| 82 | + ✅ Require approval of the most recent reviewable push |
| 83 | + ✅ Require review from Code Owners (optional) |
| 84 | +
|
| 85 | +✅ Require status checks to pass before merging |
| 86 | + ✅ Require branches to be up to date before merging |
| 87 | + Status checks: |
| 88 | + - test (Node.js 18.x) |
| 89 | + - test (Node.js 20.x) |
| 90 | + - test (Node.js 22.x) |
| 91 | + - coverage |
| 92 | +
|
| 93 | +✅ Require conversation resolution before merging |
| 94 | +
|
| 95 | +✅ Require deployments to succeed before merging |
| 96 | + Required deployment environments: |
| 97 | + - staging |
| 98 | +
|
| 99 | +✅ Restrict who can push to matching branches (optional) |
| 100 | + Allowed: staging branch, hotfix/* branches |
| 101 | +
|
| 102 | +✅ Include administrators |
| 103 | +
|
| 104 | +❌ Allow force pushes (disabled) |
| 105 | +❌ Allow deletions (disabled) |
| 106 | +``` |
| 107 | + |
| 108 | +**Deployment:** ✅ Auto-deploy to Production environment |
| 109 | + |
| 110 | +--- |
| 111 | + |
| 112 | +## Environment Configuration |
| 113 | + |
| 114 | +Configure these in **Settings → Environments**: |
| 115 | + |
| 116 | +### Staging Environment |
| 117 | + |
| 118 | +``` |
| 119 | +Name: staging |
| 120 | +Protection rules: |
| 121 | + ✅ Required reviewers: 1 |
| 122 | + ✅ Wait timer: 0 minutes |
| 123 | +
|
| 124 | +Environment secrets: |
| 125 | + - STAGING_TOKEN (if needed) |
| 126 | +``` |
| 127 | + |
| 128 | +### Production Environment |
| 129 | + |
| 130 | +``` |
| 131 | +Name: production |
| 132 | +Protection rules: |
| 133 | + ✅ Required reviewers: 2 |
| 134 | + ✅ Wait timer: 5 minutes (optional safety delay) |
| 135 | +
|
| 136 | +Environment secrets: |
| 137 | + - NPM_TOKEN (for npm publishing) |
| 138 | + - PRODUCTION_TOKEN (if needed) |
| 139 | +``` |
| 140 | + |
| 141 | +--- |
| 142 | + |
| 143 | +## CODEOWNERS File (Optional) |
| 144 | + |
| 145 | +Create `.github/CODEOWNERS` to automatically request reviews: |
| 146 | + |
| 147 | +``` |
| 148 | +# Default owners for everything |
| 149 | +* @team-lead @senior-dev |
| 150 | +
|
| 151 | +# Specific files |
| 152 | +/.github/ @devops-team |
| 153 | +/docs/ @documentation-team |
| 154 | +``` |
| 155 | + |
| 156 | +--- |
| 157 | + |
| 158 | +## Verification |
| 159 | + |
| 160 | +After configuring, verify: |
| 161 | + |
| 162 | +1. ✅ Try to push directly to `develop` (should fail) |
| 163 | +2. ✅ Try to push directly to `staging` (should fail) |
| 164 | +3. ✅ Try to push directly to `main` (should fail) |
| 165 | +4. ✅ Create PR without CI passing (should be blocked) |
| 166 | +5. ✅ Create PR without reviews (should be blocked) |
| 167 | + |
| 168 | +--- |
| 169 | + |
| 170 | +## Quick Reference |
| 171 | + |
| 172 | +| Branch | Reviewers | Status Checks | Force Push | Deploy | |
| 173 | +|-----------|-----------|---------------|------------|--------| |
| 174 | +| `develop` | 1 | ✅ | ❌ | ❌ | |
| 175 | +| `staging` | 1 | ✅ | ❌ | ✅ | |
| 176 | +| `main` | 2 | ✅ | ❌ | ✅ | |
0 commit comments