Protect default branch by default.

CHANGELOG

@@ -3,6 +3,7 @@ v 7.4.0
   - Fix creating new files with web editor
   - Improve error reporting on users API (Julien Bianchi)
   - Refactor test coverage tools usage. Use SIMPLECOV=true to generate it locally
+  - Default branch is protected by default
   - Increase unicorn timeout to 60 seconds
   - Sort search autocomplete projects by stars count so most popular go first
 

app/services/git_push_service.rb

@@ -29,6 +29,8 @@ class GitPushService
         if is_default_branch?(ref)
           # Initial push to the default branch. Take the full history of that branch as "newly pushed".
           @push_commits = project.repository.commits(newrev)
+          # Default branch is protected by default
+          project.protected_branches.create({ name: project.default_branch })
         else
           # Use the pushed commits that aren't reachable by the default branch
           # as a heuristic. This may include more commits than are actually pushed, but