Configure GitHub branch protection on main in redhat-openshift-builds/shipwright-io to prevent accidental downstream patches. Restrict pushes to only the sync automation bot/service account. Block direct pushes – all changes to main come through automated submodule bump PRs. Require status checks to pass before merge. Disable admin bypass. This ensures main stays clean and all release-specific work happens on builds-1.x branches.