{"id":49493,"date":"2025-05-27T02:29:43","date_gmt":"2025-05-27T02:29:43","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49493"},"modified":"2026-02-21T07:28:56","modified_gmt":"2026-02-21T07:28:56","slug":"gitlab-code-protected-git-branches-tutorial-guide","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/gitlab-code-protected-git-branches-tutorial-guide\/","title":{"rendered":"GitLab Code &#8211; Protected Git Branches \u2013 Tutorial Guide"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"522\" src=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-22-1024x522.png\" alt=\"\" class=\"wp-image-49494\" srcset=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-22-1024x522.png 1024w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-22-300x153.png 300w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-22-768x391.png 768w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-22-1536x783.png 1536w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-22.png 1907w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Here is a <strong>comprehensive tutorial<\/strong> for understanding and configuring <strong>Protected Branches<\/strong> in <strong>GitLab 18.0<\/strong>, based on the image you&#8217;ve provided and the latest official documentation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udd10 GitLab Protected Branches \u2013 Tutorial Guide (v18.0)<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udcd8 Purpose:<\/h3>\n\n\n\n<p>Protecting branches in GitLab helps teams:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prevent <strong>force pushes<\/strong><\/li>\n\n\n\n<li>Restrict <strong>who can merge or push<\/strong><\/li>\n\n\n\n<li>Enforce <strong>code review via merge requests<\/strong><\/li>\n\n\n\n<li>Safeguard <strong>main\/stable branches<\/strong> from accidental or unauthorized changes<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd11 What is a Protected Branch?<\/h2>\n\n\n\n<p>A <strong>protected branch<\/strong> is a Git branch that has <strong>rules and restrictions<\/strong> applied to prevent:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Direct pushes (without approvals or pipelines)<\/li>\n\n\n\n<li>Deletion by mistake<\/li>\n\n\n\n<li>Bypassing CI\/CD requirements<\/li>\n<\/ul>\n\n\n\n<p>GitLab typically uses it for <code>main<\/code>, <code>master<\/code>, <code>release\/*<\/code>, or <code>production<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 Capabilities of Protected Branches<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Restriction<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>Prevent Direct Pushes<\/td><td>Only selected roles can push<\/td><\/tr><tr><td>Prevent Force Pushes<\/td><td>Force-push is disabled<\/td><\/tr><tr><td>Restrict Who Can Merge<\/td><td>Only selected users\/roles can merge<\/td><\/tr><tr><td>Require Merge Requests<\/td><td>Enforce review before integration<\/td><\/tr><tr><td>Status Check Enforcement (EE+)<\/td><td>Only allow merge if pipelines pass<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udee0\ufe0f How to Protect a Branch in GitLab (GitLab Cloud \/ v18.0+)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd39 Option 1: <strong>Using Branch Rules (Recommended)<\/strong><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Step-by-Step:<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to your <strong>Project \u2192 Settings \u2192 Repository<\/strong><\/li>\n\n\n\n<li>Scroll to <strong>Branch Rules<\/strong><\/li>\n\n\n\n<li>Click <strong>\u201cAdd branch rule\u201d<\/strong><\/li>\n\n\n\n<li>In the modal:\n<ul class=\"wp-block-list\">\n<li><strong>Branch name<\/strong>: e.g., <code>main<\/code> or <code>release\/*<\/code><\/li>\n\n\n\n<li><strong>Allowed to push<\/strong>: Choose <code>Maintainers<\/code>, <code>Developers + Maintainers<\/code>, or custom users\/groups<\/li>\n\n\n\n<li><strong>Allowed to merge<\/strong>: Choose same<\/li>\n\n\n\n<li>Optionally enable:\n<ul class=\"wp-block-list\">\n<li>\u2705 Require merge request approvals<\/li>\n\n\n\n<li>\u2705 Require successful pipeline<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Click <strong>\u201cCreate\u201d<\/strong><\/li>\n<\/ol>\n\n\n\n<p>\ud83c\udfaf Now the branch is <strong>protected under branch rules<\/strong> \u2014 future pushes &amp; merges are restricted.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd39 Option 2: [Legacy] Using Protected Branches Panel (Deprecated)<\/h3>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>In GitLab 18.0+, this is deprecated and migrated under <strong>Branch Rules<\/strong> UI.<br>Still visible under:<br><code>Settings \u2192 Repository \u2192 Protected branches<\/code> section.<\/p>\n<\/blockquote>\n\n\n\n<p>Here:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You can protect\/unprotect branches<\/li>\n\n\n\n<li>Define who can push\/merge<\/li>\n\n\n\n<li>Redirects to <strong>Branch Rules<\/strong> now<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">\ud83c\udfaf Best Practices<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u2705 Protect all <strong>main<\/strong>, <strong>release<\/strong>, and <strong>production<\/strong> branches<\/li>\n\n\n\n<li>\u2705 Require <strong>merge requests<\/strong> to enforce peer reviews<\/li>\n\n\n\n<li>\u2705 Require <strong>pipeline success<\/strong> before merge (CI\/CD)<\/li>\n\n\n\n<li>\u2705 Allow only <strong>maintainers<\/strong> to merge into protected branches<\/li>\n\n\n\n<li>\ud83d\udeab Avoid giving push access to Developers on protected branches unless justified<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udca1 Real-World Example: Protect <code>main<\/code> Branch<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Setting<\/th><th>Value<\/th><\/tr><\/thead><tbody><tr><td>Branch name<\/td><td><code>main<\/code><\/td><\/tr><tr><td>Allowed to push<\/td><td><code>Maintainers only<\/code><\/td><\/tr><tr><td>Allowed to merge<\/td><td><code>Maintainers only<\/code><\/td><\/tr><tr><td>Require pipeline<\/td><td>\u2705 Enabled<\/td><\/tr><tr><td>Require approvals<\/td><td>\u2705 Enabled (2 reviewers)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udcce CLI Tip (Git)<\/h2>\n\n\n\n<p>Once protected:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-comment\"># Direct push will fail (if you're not allowed)<\/span>\ngit push origin main\n<span class=\"hljs-comment\"># You must open a Merge Request instead<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udcf7 Reference Screenshot Explanation (from your image)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u2705 <strong>Branch Rules<\/strong> are shown for <code>main<\/code> (default, protected)<\/li>\n\n\n\n<li>\u2705 Add new rules via <strong>&#8220;Add branch rule&#8221;<\/strong><\/li>\n\n\n\n<li>\ud83d\udd12 Protected Branches section redirects to branch rules (GitLab is deprecating old interface)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\uddea Need More?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/docs.gitlab.com\/user\/project\/repository\/branches\/protected\/\" target=\"_blank\" rel=\"noopener\">GitLab Protected Branch Docs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.gitlab.com\/ee\/user\/project\/repository\/branch_rules.html\" target=\"_blank\" rel=\"noopener\">Branch Rules Overview<\/a><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here is a comprehensive tutorial for understanding and configuring Protected Branches in GitLab 18.0, based on the image you&#8217;ve provided and the latest official documentation. \ud83d\udd10 GitLab Protected Branches \u2013 Tutorial Guide (v18.0) \ud83d\udcd8 Purpose: Protecting branches in GitLab helps teams: \ud83d\udd11 What is a Protected Branch? A protected branch is a Git branch that&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-49493","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49493","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49493"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49493\/revisions"}],"predecessor-version":[{"id":58989,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49493\/revisions\/58989"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49493"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49493"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49493"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}