Master branch has no protection rules

[miinso]

master has no branch protection. force pushes, direct commits, and merges without review are all possible. for a package that downstream builds depend on, this is a risk.

ref #1