That seems reasonable to perform on protected branches, but I’m not a fan of protecting all branches. That could leave valuable code with a single copy on a dev machine. I’d rather have it pushed to an unprotected branch and then be checked on merge instead of push.