How do you configure branch protection rules to enforce a merge-request-only workflow?

To make sure no one can bypass code review by pushing straight to a release branch, protection has to be configured at the branch level, not just relied on as a team convention.

1. Go to Settings > Repository > Protected branches.
2. Select the branch (e.g. main) or a wildcard pattern (e.g. release/*).
3. Set Allowed to push and merge to No one, so direct pushes are impossible for everyone, including Maintainers.
4. Set Allowed to merge to the roles or specific users permitted to accept merge requests.
5. Optionally enable Code Owner approval required so ownership rules from the CODEOWNERS file are enforced.
6. Combine with a merge request approval rule requiring a minimum approval count and a passing pipeline before the merge button unlocks.

With these set, the only way changes reach the protected branch is through a reviewed, approved, pipeline-passing merge request; the CLI simply rejects a direct git push origin main from anyone, regardless of their general repository permissions.