Removing a group from a project removes it's access levels (if any).

(Protected branch access levels)

app/models/project_group_link.rb

@@ -16,6 +16,8 @@ class ProjectGroupLink < ActiveRecord::Base
   validates :group_access, inclusion: { in: Gitlab::Access.values }, presence: true
   validate :different_group
 
+  before_destroy :delete_branch_protection
+
   def self.access_options
     Gitlab::Access.options
   end
@@ -35,4 +37,11 @@ class ProjectGroupLink < ActiveRecord::Base
       errors.add(:base, "Project cannot be shared with the project it is in.")
     end
   end
+
+  def delete_branch_protection
+    if group.present? && project.present?
+      project.protected_branches.merge_access_by_group(group).destroy_all
+      project.protected_branches.push_access_by_group(group).destroy_all
+    end
+  end
 end

app/models/protected_branch.rb

@@ -22,6 +22,14 @@ class ProtectedBranch < ActiveRecord::Base
   # access to the given user.
   scope :push_access_by_user, -> (user) { PushAccessLevel.joins(:protected_branch).where(protected_branch_id: self.ids).merge(PushAccessLevel.by_user(user)) }
 
+  # Returns all merge access levels (for protected branches in scope) that grant merge
+  # access to the given group.
+  scope :merge_access_by_group, -> (group) { MergeAccessLevel.joins(:protected_branch).where(protected_branch_id: self.ids).merge(MergeAccessLevel.by_group(group)) }
+
+  # Returns all push access levels (for protected branches in scope) that grant push
+  # access to the given group.
+  scope :push_access_by_group, -> (group) { PushAccessLevel.joins(:protected_branch).where(protected_branch_id: self.ids).merge(PushAccessLevel.by_group(group)) }
+
   def commit
     project.commit(self.name)
   end

app/models/protected_branch/merge_access_level.rb

@@ -11,6 +11,7 @@ class ProtectedBranch::MergeAccessLevel < ActiveRecord::Base
                                                              Gitlab::Access::DEVELOPER] }
 
   scope :by_user, -> (user) { where(user: user ) }
+  scope :by_group, -> (group) { where(group: group ) }
 
   def self.human_access_levels
     {

app/models/protected_branch/push_access_level.rb

@@ -12,6 +12,7 @@ class ProtectedBranch::PushAccessLevel < ActiveRecord::Base
                                                              Gitlab::Access::NO_ACCESS] }
 
   scope :by_user, -> (user) { where(user: user ) }
+  scope :by_group, -> (group) { where(group: group ) }
 
   def self.human_access_levels
     {