feat: allow API to bypass branch protections with elevated token #222

New Issue

2026-05-26T20:23:09Z

jmiller commented

2026-05-26 20:23:09 +00:00

Summary

Add a mechanism for the API to bypass branch protection rules when using an appropriately scoped token or admin-level credentials. This would allow automation (CI/CD pipelines, release tooling, Claude Code) to push directly to protected branches when needed without disabling protections for human users.

Motivation

Branch protections are essential for human workflows, but automated pipelines (e.g. release promotion, hotfix merges, backports) sometimes need to push to protected branches. Currently there is no way to do this via the API without temporarily disabling protections, which creates a security window.

Proposed Behavior

Admin tokens or tokens with a specific scope (e.g. repo:bypass-protection) can push/merge to protected branches via the API
Web UI protections remain enforced for all users
Audit log entries should clearly indicate when a bypass was used

References

GitHub supports this via "Allow specified actors to bypass required pull requests" in branch protection rules

Opened by Claude Code on behalf of @jmiller

## Summary Add a mechanism for the API to bypass branch protection rules when using an appropriately scoped token or admin-level credentials. This would allow automation (CI/CD pipelines, release tooling, Claude Code) to push directly to protected branches when needed without disabling protections for human users. ## Motivation Branch protections are essential for human workflows, but automated pipelines (e.g. release promotion, hotfix merges, backports) sometimes need to push to protected branches. Currently there is no way to do this via the API without temporarily disabling protections, which creates a security window. ## Proposed Behavior - Admin tokens or tokens with a specific scope (e.g. `repo:bypass-protection`) can push/merge to protected branches via the API - Web UI protections remain enforced for all users - Audit log entries should clearly indicate when a bypass was used ## References - GitHub supports this via "Allow specified actors to bypass required pull requests" in branch protection rules --- *Opened by Claude Code on behalf of @jmiller*

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-APP#222