Having protected branch makes sense as not allowing force push may safe us from loosing commits. As for the PR requirement it makes some small changes (like bumping the pom version) a bit more tedious to do, but I'm fine with that. I'm just not sure about how to perform the release. One option is make the release from branch different than master and let Maven push it together with the tag. But I'm not sure if the branch name is written somewhere. Probably is indeed safer to use -DpushChanges=false. Does the following makes sense:

1. Prepare release from master branch with -DpushChanges=false. Push the master branch as release/...
2. Make PR
3. Merge the change (after approval from somebody else?)
4. Push the tag
5. Pull the new master branch (which is identical as yours as we don't do merges)
6. Continue from here as normal release (release:perform does not push changes, right?)

Uhm I wouldn;t use such workflow.

1. create a branch from master called release/5.1 if releasing 5.1
2. from this branch mvn release:prepare release:perform -DlocalCheckout=true -DpushChanges=false
3. push manually the tag
4. create a PR from the branch release/5.1 to sync release steps and new xx-SNAPSHOT version

makes sense?

I did some dry runs. It appears that the release plugin does not use the current branch but rather the scm configuration from the pom. I could be wrong though. Anyway -DpushChanges=false and -DlocalCheckout=true did the trick. Thanks for the help.