Branch protection too weak (GitLab)
Part of the GitLab project protection check · fix arrives as a guide
What it is
The default branch is protected but the rule is weak — developers can push directly, or force push is still allowed.
Why it matters
The settings page shows protection while the specific gap that matters stays open. Allowing developer push in particular means the merge request flow is optional rather than enforced.
Protected is not the same as protected well
A GitLab branch can be “protected” while still accepting direct pushes from every developer and force pushes that rewrite history. The rule that ships by default — Maintainers can push, Developers+Maintainers can merge — is a starting point, not a policy. The settings live at Settings → Repository → Protected branches.
The configuration that actually blocks mistakes
Allowed to push and merge: No one
Allowed to merge: Maintainers (or Developers, if review gates merges)
Allowed to force push: Off
Code owner approval: On (Premium — CODEOWNERS file required)“Allowed to push: No one” is the line that matters — it makes the merge request the only path into the branch, which is what lets pipeline gates and review actually gate anything. Force push stays off because a rewritten default branch breaks every clone and hides history you may need in an incident.
Set it via the API
# 0 = No one, 30 = Developers, 40 = Maintainers
curl -X POST "https://gitlab.com/api/v4/projects/$PROJECT_ID/protected_branches" \
-H "PRIVATE-TOKEN: $GITLAB_TOKEN" \
-d 'name=main&push_access_level=0&merge_access_level=40&allow_force_push=false'Re-running for an existing rule? Delete and recreate it — the protected-branches API replaces rather than patches.
Pair it with the merge checks
Branch protection controls *who* can get code in; merge checks control *what* gets in. The pair to enable next door (Settings → Merge requests): Pipelines must succeed, and approvals if your tier has them. One without the other leaves a gap wide enough to merge a Friday hotfix through.
How lumioguard fixes it
The scan reads every protected-branch rule and flags the weak lines — push access above No one, force push allowed, missing code-owner gate. The fix arrives as a guide with the exact settings per branch and the API calls to apply them.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.