Protection
Rules for lines and refs. A protected line or ref moves only to a state that passes its rules, with compare and swap. Approvals bind to that exact state; a path rule names the role needed to change files under it.
| Line or ref | Required checks | Approvals | Path requirements | Direct saves | Who may move | |
|---|---|---|---|---|---|---|
| main | unit, lint, e2e | 2 from maintainers | migrations/ → maintainer .layr/ → admin | not allowed | maintainers | |
| env/prod | unit, e2e | 1 from alice, bob | · | · | maintainers | |
| env/staging | unit | 0 | · | · | writers | |
| release/* | build-image | 1 from alice | · | · | maintainers |
$ protect env/prodlayr protect env/prod --check unit --approvals 1 --approvers alice,bob
$ protect mainlayr protect main --path migrations/=maintainer