An organisation is migrating one team's repository from "Azure Repos" to "GitHub" but wants to keep an equivalent merge gate: pull requests into the protected branch must collect required reviews and pass required checks. Which capability provides the same enforcement that branch policies gave them in Azure Repos?
- AAzure Pipelines environment approvals, which pause a deployment until a named approver signs off and therefore hold each pull request until the required reviews and checks are satisfied.
- BA repository ruleset scoped to tags, which applies required reviews and checks to tag creation and therefore enforces the same gate when a pull request is merged into the protected branch.
- CGitHub Actions workflow permissions set to read and write, which let the build workflow approve its own pull requests once the required reviews and checks have completed successfully.
- DGitHub branch protection rules, or repository rulesets, on the protected branch that require pull request reviews and required status checks before a merge is permitted. Correct
Why A is wrong: Environment approvals gate deployments to an environment, not pull request merges; the wording is tempting because it mentions approvers, but it operates after merge during release, not on the pull request.
Why B is wrong: Rulesets can target tags, which sounds plausible, but a tag-scoped ruleset governs tag operations rather than branch merges, so it would not gate pull requests into the protected branch.
Why C is wrong: Workflow permissions control what the workflow token can do in a run; it is tempting because it touches Actions, but it does not enforce any merge gate and a workflow cannot satisfy required human reviews.
Why D is correct: Branch protection rules and rulesets are the GitHub equivalent of Azure Repos branch policies, enforcing required reviews and required status checks on merges into the protected branch.