# GitHub Branch Protection Rules Are No Longer Enough

GitHub audit logs track access and admin actions—but they miss most of what matters for delivery governance.

## What GitHub branch protection can do

GitHub's branch protection rules cover the basics: required reviews, status checks, linear history, and force push prevention. These are good baseline controls—but they're binary: on or off. They don't understand context.

- Require N approvals before merge
- Require passing status checks
- Require signed commits
- Prevent force pushes

## What they can't do

The most important delivery signals happen at the PR and deployment level, and GitHub branch protection rules miss them entirely:

- Can't detect self-approvals—GitHub doesn't check if an approver is the PR author
- Can't require linked issues—PRs with unclear scope merge anyway
- Can't cap PR size—a 1,000-line PR gets the same treatment as a 10-line fix
- Can't adapt based on developer role—protection rules are the same for everyone
- Can't track agent-authored code—GitHub has no concept of AI agent PRs

## From binary rules to context-aware governance

Warestack adds context-aware enforcement on top of GitHub's baseline rules. Instead of binary on/off switches, you get declarative policies that understand who is shipping, what they're changing, and whether the output matches the intent.

## What Warestack adds

Warestack ingests GitHub events in real time and enriches them with metadata that branch protection rules can't provide:

- Detect self-approvals and block them before merge
- Require linked Linear/Jira issues on every PR
- Cap PR size at configurable thresholds (e.g., 500 LOC)
- Adapt review requirements based on developer role and file paths
- Track agent-authored code and enforce stricter standards for AI-generated PRs

### Go beyond branch protection

Get context-aware enforcement with Warestack's governance layer.

## Frequently asked questions

### Should I keep GitHub branch protection enabled?

Yes! GitHub branch protection provides good baseline controls. Warestack adds intelligent, context-aware checks on top.

### Can I customize which checks run?

Yes. Warestack provides a catalog of pre-built checks. Enable the ones you need, write custom checks in YAML or natural language.

### How does this work with AI-generated code?

Warestack can detect agent-authored PRs (via commit patterns, author metadata) and apply stricter review standards automatically.