Require reviewed changes

A protected branch turns the expected release path into an enforceable rule. Review is strongest when the change is small enough to understand.

Require pull requests, current approvals, status checks, and restricted force pushes. Protect workflow and dependency files with appropriate owners. Record and review any bypass after the emergency ends.

A pull request changes application code and the workflow that tests it. The altered workflow reports success without running the security check, so a green badge alone does not represent independent review.

Emergency bypass can be necessary during an outage. The tradeoff is concentrated authority, so the bypass must be attributable, time-bounded, and reviewed afterward.

Create a test branch rule that requires one approval and one real status check. Save evidence that a failing unreviewed change cannot merge. Then exercise the documented bypass in a disposable repository and show where the event is logged and how normal protection is restored.