conditionally protect the repos if they are update vs kickstart style