Merge Request Pipelines Only On Protected Branches

:wave: ,

I try to run my merge request pipelines only if the target is a protected branch but fail to achieve my goal.

This is my approach:

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_PROTECTED
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
      when: never
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

This approach runs all the time nevertheless if the target branch is protected or not.

Can someone please enlighten me what Iā€™m doing wrong. That would be much appreciated!

Thank you!