How to enforce branch protection in GitHub Classroom (Protected file paths?)

[ualjjcanada]

Hi everyone,

I want my students to follow the GitHub Flow workflow, so I would like to protect the main branch to prevent direct commits and require them to work through branches and Pull Requests before merging into main.

I’m not sure whether the new Protected file paths feature in GitHub Classroom assignments can enforce this behavior. The documentation states:

Assign protected file paths to monitor whether students change tests or other important files. A ‘Protected file(s) modified)’ label will be applied to student submissions that change protected files on the assignment dashboard.

However, this sounds more like a monitoring mechanism rather than branch protection.

If possible, I would really appreciate some guidance on how to properly set up branch protection rules in the context of GitHub Classroom assignments, or whether this can be configured directly within a template repository.

Thanks in advance for your support.
Joaquín

[Sultan-Moulana]

Hi Joaquín,

You are absolutely correct in your suspicion: "Protected file paths" in GitHub Classroom will not achieve what you are looking for.

Here is the breakdown of why, and the solution to enforce the GitHub Flow (Pull Requests) workflow for your students.

1. Clarification: "Protected File Paths"
   As you surmised, this feature is strictly a monitoring mechanism. It is designed to prevent students from modifying grading assets (like auto-grading scripts or unit tests). If a student modifies a file listed here, it simply flags the submission on your dashboard or potentially resets that specific file during grading; it does not prevent direct commits to the main branch.

2. The Solution: Organization Rulesets (Best Practice)
   In the past, branch protection rules had to be set per repository, and they did not copy over from Template repositories automatically. This made Classroom management a nightmare.

However, GitHub recently introduced Repository Rulesets, which is the perfect solution for this. You can define a rule at the Organization level that applies to all current and future student repositories automatically.

How to set it up:

1. Go to your Organization Settings (not the classroom settings, but the actual GitHub Org).

2. In the sidebar, look for Code, planning, and automation -> Repository -> Rulesets.

3. Click New branch ruleset.

4. General Settings:
   • Give it a name (e.g., "Student PR Workflow").
   • Set Enforcement status to Active.

5. Target Repositories:
   • Select Target: Dynamic list of repositories.
   • You can target All repositories (if your org is only for this class) or use fnmatch syntax to target specific naming conventions (e.g., if your assignments are named assignment-1-username, you can target assignment-*).

6. Target Branches:
   • Click Add target -> Include default branch (this catches main or master automatically).

7. Rules (The important part):
   • Check Restrict deletions.
   • Check Block force pushes.
   • Check Require a pull request before merging.

Optional: Set "Required number of approvals" to 0 if you want them to be able to merge their own PRs (simulating the flow), or 1 if you want them to review each other/you to review.

Why this works for Classroom
Because this rule lives at the Organization level, as soon as GitHub Classroom creates a new repository for a student, this Ruleset detects it and immediately locks down the main branch. The student will be forced to create a feature-branch, push it, and open a Pull Request to merge their changes, effectively forcing them to learn GitHub Flow.

Hope this helps!

[vin1397]

Why don't you add new branch to repo so that way you can protect your original code