Github introduced protected branches feature:
Can't be force pushed
Can't be deleted
Can't have changes merged into them until required status checks pass
Seems like this should be enabled on all our moodle.git branches.