When all of these conditions are met:
Ref name matches regexp @^(master|production)$@
Ref change type has bit dangerous change
Repository is not any of Restricted Repository, Unknown Object (Repository), Unknown Object (Repository)
Repository projects include none of Language-Puppet
Take these actions every time this rule matches:
Block push with message: dangerous changes to master or production branch are forbidden