The city’s IaC monorepo protects main so infrastructure changes receive review. Why are direct commits to main typically blocked?
Select an answer to reveal the explanation.
Short Explanation
Protected main is the locked evidence room — you submit a merge request, get eyes on the IaC change, then it goes in. Walking in with an unreviewed commit is exactly what the lock prevents.
Full Explanation
City IaC monorepos typically protect the default branch so infrastructure changes cannot land without review. Direct commits to main are blocked so that unreviewed Terraform, Bicep, or related definitions never become the next apply input. Reviewed merges through pull or merge requests keep accidental, incomplete, or unvetted infrastructure edits off the protected default branch and create an approval trail for auditors.
Blocking main does not force every change into chat screenshots; version control remains the system of record via feature branches and MRs. Protected branches do not make Git stop tracking files larger than one kilobyte—that claim confuses branch rules with unrelated limits. Direct commits are not blocked solely to increase CI minutes billed to the city; the purpose is change control and safety.
Exam caveat: administrators may retain break-glass push rights for emergencies, but the exam’s expected design is MR-only for normal work. Operational check: with a standard developer role, attempt git push to main and confirm rejection; open an MR, obtain required approvals and CI green, merge, and verify main advances only via that path. For IaC monorepos, blocking direct main commits is especially important because a bad merge can trigger automatic applies that change production VPC or IAM state. Review plus plan output in the MR is the municipal safety net.