There are 2 ways to protect a GitHub repository/branch from force pushing:
1) a backend switch (not available in their UI) to disable force pushing for the entire repo (OLD)
2) "protected branches" in the "settings" menu of each repo, in the submenu "branches".

Some repositories, such as "drools" and "optaplanner", have 1), so all their branches are immune to force pushing.
Newer repositories, such as "optaplanner-wb" probably don't have 1).

All repositories seem to have 2) for the following branches: master, 6.4.x, 6.5.x.
BUT NOT 7.3.x etc. That's wrong: this means optaplanner-wb's 7.3.x branch is not protected against force pushes.

All release branches (7.0.x, 7.1.x, ...) should be protected against force pushing. This includes future release branches, so the release procedure should be adjusted accordingly.

We should ask github if there's a way to automatically add all new branches to "protected branches".