The default branch requires review and passing checks before merge, and rejects force pushes
Branch protection is the only rule here that a repository setting enforces rather than a file. Without it, every other rule in this document can be bypassed by one push.
Observable check
the default branch is protected, requires at least one approving review, requires the CI status check to pass, and blocks force pushes and deletion. Read the settings with gh api repos/{owner}/{repo}/branches/{branch}/protection on GitHub, or GET /projects/:id/protected_branches/:name on GitLab.