When all of these conditions are met:
Pusher is any of swh-public-ci
Repository projects include all of Has debian packaging branches
Ref name does not match regexp @^(debian/.*|pristine-tar)$@
Take these actions every time this rule matches:
Block push with message: public-ci is only allowed to push to the debian refs