Strengthen branch protection policy on main

[jeremyeder]

Problem

Branch protection is enabled on main, but the current policy is minimal and does not enforce meaningful review gates:

• Required approving reviews: 0 — PRs can be merged without any approval
• Dismiss stale reviews: No
• Require code owner reviews: No
• Require signed commits: No
• Enforce for admins: No

This effectively allows direct merges without review.

Recommended Changes

Update the branch protection rule on main to include:

• Require at least 1 approving review
• Dismiss stale pull request approvals when new commits are pushed
• Do not allow force pushes (already set)
• Do not allow deletions (already set)
• Consider: Require code owner reviews
• Consider: Require signed commits
• Consider: Include administrators in these restrictions

How To Update

1. Go to Settings > Branches
2. Edit the existing main protection rule
3. Under "Require a pull request before merging", set Required number of approvals to at least 1
4. Enable Dismiss stale pull request approvals when new commits are pushed
5. Save changes

References

• GitHub docs: Managing a branch protection rule