Which protection did that branch set?

A client says the branch is protected, or says a force push still landed on the branch the contract called protected. Tonight, three proofs, in a repository the agency or the client can open. Name the protection the branch set: the required review count, the status-check contexts, and whether the branch is locked. Show a different protection whose review count, or whose context list, is not this one. Show another client's repository that does not list this protection. If any of the three needs a dashboard you cannot open, you have not named the protection. You have a screenshot and a guess.

This is branch protection on one branch. It is not the ruleset a push hit. Which ruleset did that push hit? is a ruleset id, a name, and an enforcement value. A classic protection can require reviews while no ruleset id exists, and a ruleset can exist while this endpoint returns nothing. It is not the context a status named. Which context did that status name? is a status id on a commit. A string in required_status_checks is not that status id. It is not the check a commit reported. Which check did that commit report? is a check on a sha. It is not the transfer a charge created. Which transfer did that charge create? is a transfer id. It is not the input a response sent. Which input did that response send? is an input item id. A branch rule is none of those.

None of what follows is a promise about this client's repository, and none of it is legal advice. The fields below are one host's current request samples for branch protection. The samples that share a context name do not share a list. The figures below that are one firm's count of other people's starred repositories, not the rule on the branch in front of you. A percentage of famous repositories is not the protection this branch set.

GitHub's update-protection request is one sample, and the page does not print a response body for it. It prints a request and then a response schema. A schema is not a url you can open, and it is not a second repository. The request sets required_status_checks.strict to true and names one context, continuous-integration/travis-ci. 32 characters. required_approving_review_count is 2. The schema says that integer has a minimum of 0 and a maximum of 6. 2 is not 0, and 2 is not 6. The parameter text says the object requires at least one approving review, and that null disables it. At least one is not the integer 2, and the minimum 0 is not at least one. Three floors, one example. dismiss_stale_reviews is true. require_code_owner_reviews is true. require_last_push_approval is true. dismissal_restrictions names the user octocat, 7 characters, and the team justice-league, 14 characters. bypass_pull_request_allowances names the same user and the same team. restrictions names octocat, justice-league, and the app super-ci. 8 characters. 8 is not 7, and 8 is not 14. enforce_admins is true. required_linear_history is true. The parameter text says the repository must allow squash or rebase merging before a linear history can be required. The request does not include a merge-method field. allow_force_pushes is true. allow_deletions is true. block_creations is true. The default the page prints for block_creations is false. required_conversation_resolution is true. Its default is false. lock_branch is true. Its default is false. allow_fork_syncing is true. Its default is false. The lock text says that if lock_branch is true, users will not be able to push to the branch. The force-push text says true permits force pushes by anyone with write access. The same request sets both to true. The page does not say which one wins. allow_fork_syncing is described as whether users can pull upstream changes when the branch is locked, and this request turns the lock on and the sync on together. Do not collapse lock and force-push into one sentence because they arrived in one JSON object. The documented header is X-GitHub-Api-Version 2026-03-10. 10 characters. 10 is not 2, and 10 is not 6. Update returns 200, 403, 404, or 422. Get protection returns 200 or 404. 404 is not a review count of 0. A missing protection is not a protection whose count is zero (GitHub, REST API endpoints for protected branches).

The context requests are different lists, on the same placeholder branch, and they are still requests. The add request names two contexts: continuous-integration/travis-ci, 32 characters, and continuous-integration/jenkins, 30 characters. 32 is not 30. Two names are not the one name on the update request. The set request, a PUT, names only travis-ci. It does not name jenkins. A PUT that replaces the list is not an add that appended a name, and the page does not print the list that was there before the PUT. The delete request names only jenkins. Removing jenkins is not the same object as a list that still contains jenkins, and it is not the update request, which never named jenkins. The review-protection patch sets required_approving_review_count to 2 again, and its app slug is octoapp. 7 characters, the same length as octocat, and not the same string. The team-removal example names octocats. 8 characters, the same length as super-ci, and not that string. octocats is not justice-league, and it is not octocat. Deleting status-check protection returns 204 with no body. 204 is not 200. A 204 cannot name a context, because it has no body. Do not paste travis-ci onto a 204 because an earlier request used that name. The path in every example is OWNER, REPO, and BRANCH. Those three words are placeholders. A placeholder is not your client's repository, and two requests that share the placeholder are not two clients.

The count people reach for when they want a protection percentage did not open this branch. Arnica, in a note posted 2 June 2026 by Chris Abraham, says it queried the top 250 starred projects on GitHub. Table 1 says branch protection is enabled on 52 percent of them, with an average of 337 contributors, and disabled on 48 percent, with an average of 184. 52 plus 48 is 100. 52 percent of 250 is 130, which is 130 of 250. 48 percent of 250 is 120. 130 plus 120 is 250. That pair adds. The prose says the enabled group has an average contributor base that is double the other group. 184 times 2 is 368. 368 is not 337. 337 divided by 184 is 1.83, not 2. The page does not print 368 or 1.83. The prose also says 42 percent of the repos had between 0 and 50 pull requests, and that the next two intervals, 50 to 200 and 200 to 800, account for an additional 19 percent and 17 percent. 42 plus 19 plus 17 is 78. 42 percent of 250 is 105. The table prints 104 repositories in the first bin. 105 is not 104. 104 divided by 250 is 0.416, which is 41.6 percent, not 42. 19 percent of 250 is 47.5, and the table prints 47. 17 percent of 250 is 42.5, and the table prints 42. The five repo counts are 104, 47, 42, 31, and 24. The sum is 248. 248 is not 250. The gap is 2, which the page does not print. Table 3 says that with protection enabled, mean reviewer load factor 54,746 times mean PRIS 0.56 is the quality score 30,761. 54,746 times 0.56 is 30,657.76. 30,657.76 is not 30,761. The page does not print 30,657.76. With both protection and CODEOWNERS enabled, 47,025 times 1.14 is 53,608.5, and the table prints 53,654. 53,608.5 is not 53,654. The smallest bin with both settings on is printed as N/A. An empty cell is not a review count of 2, and 52 percent of someone else's starred set is not the protection on this branch (Arnica, How Top Open Source Projects Protect Their Code).

Do the three proofs on one real branch, in the repository that actually holds the rule. First, the binding. Copy the branch name, the required approving review count, the context list, and lock_branch. If the count is 2 on a sample and your rule is a different integer, write your integer. If the context list has one name, write that name. Do not expand it to two because a different request on the same docs page named jenkins. If lock_branch and allow_force_pushes are both true, write both, and write that the page you learned from did not say which one wins. If the response is 404, write 404. Do not rewrite it as a count of 0. Second, the other protection. A different count, or a different context list, is not this one. A table of 250 other repositories is not that second protection. If you cannot show a protection that is not this one, you have a counter, not a record. Third, the other repository. A rule that belongs to another client does not contain this branch. If the only screen mixes every client's branches, write that. A tenant you cannot name is the finding.

Three moves feel like the proof and are a second problem. Turning lock_branch off because a force push was convenient, before you have copied the count and the contexts. Changing the lock does not tell you which protection was set. Quoting 52 percent or 337 because they look precise, while the branch in front of you is one rule, and the note that printed them had already failed to make double mean twice and had already summed its own bins to 248. Asking a model which protection was set. The model will pick a plausible context name. It will not open the branch. A ruleset you have not kept is which ruleset did that push hit?. Opening that ruleset does not name this review count. A status context on a commit is which context did that status name?. A status id is not this required list.

The path is ordinary when an operator can open one client's repository without opening the next client's repository as the way to prove it. CampAI is an academic management platform: student lifecycle, fees, and multi-branch administration under one role-based system. The shape that matters here is one client's project you can point at, distinct from the next client's project. That case is not a branch-protection ledger. Nothing in that sentence is a headcount, a duration, or a result figure. If the only control on the screen shows every client at once and will not name a branch, you do not have this proof. You have a directory.

There is a version of this afternoon where the agency should not take the work. The work is not sold under the agency's name. The client asked to meet the builders. The room only has a slide. The buyer only wants a template. Or the buyer wants a legal opinion about what a protection promises. A white label software development partner is the page for capacity sold under the agency's name. It does not rank anyone, including us. 52 percent is not this repository, and 2 on a sample is not this repository, and 248 is not 250.

When the repository is real and the protection is not on a screen you can open, the missing object is specific. The review count, the contexts, and the lock, a different protection that is not that one, and another client's repository that does not list it. A white-label engagement that expects this will put the repository in the client's organization, or in yours, before the first push, because a rule that lives only in a vendor dashboard is not a count you can hand the client. One that can only paste protected into chat is telling you who holds the rule. Where the next slice is one capability and the acceptance sentence names the review count, an AI integration sprint is the shape that can require the three proofs as the definition of done. Where you are not sure which repository the current engagement protects, a two-week AI readiness assessment maps the systems. The findings are yours. They are not a promise that 52 percent of this tree has a protection, and they are not 2.

Before you tell the client which protection the branch set, write the three lines. The review count, the context list, and the lock, or the status code the response actually returned. A different protection that is not that one. Another repository that does not hold it. Do not treat a ruleset id as this object, and do not ask a model which context it was. A note can tell you how 250 starred repositories split, including the 248 its own table adds to. The binding is the protection you can defend.