2.1 Purpose
To maintain code quality, traceability, and integrity by standardizing how changes are version-controlled and peer-reviewed before reaching the main branch.
2.2 Scope
Applies to all source-code repositories owned or operated by [Organization] Engineering and to everyone who contributes to them.
2.3 Definitions

Main / trunk — The primary integration branch that must always be in a releasable state.
Protected branch — A branch with enforced rules (no direct pushes, required reviews, required checks).
Pull request (PR) — A proposed change submitted for review before merge.

2.4 Roles & responsibilities

Repository owners — Configure branch protection and CODEOWNERS, and keep the repo healthy.
Reviewers — Evaluate correctness, security, readability, and adherence to standards.
Engineering managers — Ensure their teams follow review practices and resolve bottlenecks.

2.5 Policy statements

All source code must reside in [the approved version-control system]. Storing production code outside approved systems is prohibited.
The main branch must always be deployable. The team's branching model is [trunk-based development / GitFlow].
Direct commits to protected branches are prohibited; all changes must be introduced through a pull request.
Every PR requires at least one approving review. Changes to authentication, authorization, cryptography, infrastructure, or other security-sensitive areas require at least two. Authors may not approve their own PRs.
All required status checks — build, automated tests, linting, and SAST — must pass before a PR can be merged.
PRs should be small and focused, carry a clear description, and link to the relevant issue or ticket.
Force-pushing or rewriting history on protected branches is prohibited.
CODEOWNERS must be configured for critical paths so the right reviewers are required automatically.
Stale and merged branches must be pruned regularly; secrets must never be introduced into repository history (see ENG-SEC-001).

2.6 Exceptions
Temporary exceptions (e.g., a documented break-glass merge) must be approved by [the Director of Engineering] and logged with justification.
2.7 Enforcement
Branch-protection settings enforce most requirements automatically. Bypasses are logged and reviewed; repeated circumvention is escalated to engineering leadership.
2.8 Related policies & references
ENG-SEC-001 (SSDLC), ENG-CHG-003 (Change Management).