How do you configure branch protection to enforce a pull-request-only workflow?

To ensure no one can bypass review by pushing straight to a release branch, protection has to be configured on the branch itself rather than relied on as a team convention.

1. Go to Settings > Branches and add a branch protection rule for the target branch (e.g. main) or a pattern (e.g. release/*).
2. Enable Require a pull request before merging, which blocks direct pushes to that branch entirely.
3. Set a minimum number of required approving reviews.
4. Enable Require review from Code Owners so ownership rules from the CODEOWNERS file are enforced.
5. Enable Require status checks to pass before merging and select the specific Actions checks that must succeed.
6. Optionally enable Do not allow bypassing the above settings so even repository admins can't skip the rule.

With these enabled, the only way changes reach the protected branch is through a reviewed, approved, passing-checks pull request; a direct git push origin main gets rejected regardless of the pusher's general repository permissions.