In the docs
Branch rules
Protect branches so they change only through change requests, can't be force-pushed or deleted, and merge only when CI passes and the review finds nothing serious.
For agents: this page as MarkdownA repository's admins set branch rules under the repository's Settings → Branch rules. A rule names a branch, or a pattern like release/*, and can:
- require a change request: the branch changes only by merging one, never by a direct push;
- block force pushes: history on the branch can't be rewritten;
- block deletion: the branch can't be deleted;
- require CI to pass: a change request into the branch merges only once every CI run on its head has passed (the latest run of each workflow, and at least one);
- block on review findings: a change request into the branch can't merge while the review of its change finds something at the level you pick or above (critical, high, medium, low, or any finding). It's the review
bit reviewruns, done by the server when you merge.
A push that breaks a rule is refused, with the rule named in git's output. A change request held back by CI or the review says why in its merge box, listing the runs or the findings with their file and line, and its merge button stays off until they clear. Merge when ready waits for them and merges by itself once they do. Several rules can match a branch; the strictest setting of each applies.
Anyone who can read the repository can see its rules.