Approvals and Checks at repository level in Azure DevOps

I am using 'Approvals and Checks' in Environments on a pipeline level, but it will be better if it can be on a repository level so that the owner/admin of a repository can define how and who can access it.

The problem though is it does not seem to work. It looks straight forward configuring it on a repository level (Project>Repositories>Policies>select any branch>Approvals and Checks>All approvers must approve), but the pipeline completes its run without asking for an approval. Any thoughts on this?

Also, I don't think it applies on a branch level, could be for the whole repository.

I was able to reproduce your problem by adding an Approval + Check condition on the repository and then queuing a pipeline that uses that repository. It does not appear that the checks can be applied to pipelines that reside within the repository.

Conceptually, it appears that this feature is intended when you are sharing a repository with others. To trigger the Approval + Checks, the pipeline must reside in a separate repository and the pipeline must consume the protected repository as a resource:

resources:
  repositories:
  - repository: external
    type: git
    name: second-repo

steps:
- checkout: external # triggers checks

Regarding branch-level checks, although the user-interface appears to support creating an Approvals + Check at the branch-level, it appears to be applied to all branches.

Incidentally, I also tried this using a pipeline that refers to templates in a shared repository. The checks were also not applied:

resources:
  repositories:
  - repository: external
    type: git
    name: second-repo

steps:
- template: shared-steps.yml@external # does not trigger checks