GitHub’s article on protected branches states that a protected branch can’t be force pushed nor can it have changes merged into it that haven’t passed CI. Asssuming you’ve set up CI on your repo, this means that you can never push to a protected branch from your local machine (even a non-forcing push), since the only way for CI to pass is through a Pull Request. What I’ve discovered though is that if you do a git push to a protected branch, GitHub rejects the branch from updating but the commit itself exists on GitHub’s server in limbo, untied to any branch (i.e. it has zero connectivity). Since GitHub never purges commits regardless of their connected state, you can access your rejected commit in perpetuity with this URL scheme:

https://github.com/<account>/<repo>/commit/<sha>