I am aware of similar questions (How to protect "master" branch in GitHub? and How can we enforce mandatory reviews in GitHub but still allow Maven release builds from CI?) and of GitHub's "protected branches" feature. Sadly, so far, I have been unable to come up with a solution that fulfills all our requirements:
- only administrators and automated process accounts (like Maven release on Jenkins) can push directly to master
- everybody else must open a pull request (which requires an approval)
- everybody can merge approved pull requests
We are a small organization on a GitHub "Team" plan, and we're happy to switch plans, if necessary. However, I'd like first to make sure that whatever other plan we choose would actually support all these requirements.