Lesson 7 of 7 · 8 min
Collaborating: workflows, pull requests and GitHub
Branching strategies, review practice, and the GitHub features that carry real weight.
Branching models
| Model | Shape | Suits |
|---|---|---|
| GitHub Flow | main plus short-lived feature branches | Continuous deployment to one environment |
| Git Flow | main, develop, release, hotfix branches | Versioned releases needing parallel support |
| Trunk-based | Commit to main behind feature flags | High-frequency deployment with strong tests |
| Fork and PR | Contributors fork, maintainers merge | Open source and untrusted contributors |
What makes a reviewable pull request
One concern per PR. A refactor and a behaviour change in the same diff cannot be reviewed properly — the reviewer cannot tell which line changed what. Split them.
Size is the strongest predictor of review quality. Under about 400 lines, reviewers find real defects; well past that, they approve. If a change is genuinely large, stack it as a series of PRs that each make sense alone.
The description should say why, not what. The diff already says what.
Merge strategies on GitHub
| Option | Result | Right when |
|---|---|---|
| Merge commit | All commits plus a merge commit | The individual commits are meaningful |
| Squash and merge | One commit on main | The branch history is work-in-progress noise |
| Rebase and merge | Commits replayed linearly, no merge commit | You want linear history and clean commits |
Making the rules enforceable
Branch protection on main is what turns a convention into a guarantee: require a pull request, require status checks to pass, require the branch to be up to date, and forbid force pushes.
CODEOWNERS routes review to the people who know the code. Required signed commits, dependency scanning and secret scanning close the remaining gaps. Without protection, every one of these is optional in practice.
Worth remembering
- Choose a branching model based on release cadence, not on fashion.
- Small pull requests get real review; large ones get approvals.
- Protected branches and required checks are what make a workflow actually hold.
Test it now
Workflow and GitHub questions appear across the medium bank.