gitgithub

Github new Branch creation restriction

I was wondering if there is anyway to restrict the branch creation in GitHub. I have 4-5 branches created for a repo and would like to maintain it that way. I have applied branch restriction rules on my master branch and hence the developers cannot merge into master but they can create their own branches . Is there a way i can restrict and force developers to use the other branches that are available and not create a new one ?

Note: I use GITHUB Enterprise

Solution

  • For GitHub Enterprise, this is available since version 3.7.0 (2022-10-25): https://docs.github.com/enterprise-server@3.7/admin/release-notes#repositories

    For public GitHub, this is supported since May 2022. See:

    Block creation of branches that have matching names

    Now, admins can block creation of branches that match a configured name pattern.

    For example, if a repository's default branch is renamed from master to main, admins can prevent any subsequent creation or push of the master branch so that only the new branch name is used.

    Previously, admins could use branch protection rules to restrict who could push to existing branches, but they couldn't block the creation of those branches.
    This is now possible using a branch protection setting named Restrict pushes that create matching branches.
    To use the setting, create a new branch protection rule with a name pattern that matches the branch name you want to block (e.g., master or not-allowed*). Then, enable the settings "Restrict who can push to matching branches" and "Restrict pushes that create matching branches", as shown here:

    An image showing the two branch protection settings to enable for restricting pushes that create matching branches -- https://i0.wp.com/user-images.githubusercontent.com/1767415/166982191-bb0af50c-971a-481c-ae80-a17ef91223c3.png?ssl=1

    For more information, visit About protected branches in the GitHub documentation.

    We appreciate feedback on this and other topics in GitHub's public feedback discussions.

    In your case, adding a rule '*' will prevent the creation of any new branch.

    Does this also restricts who is able to push to existing branches on that pattern?
    Would it be possible to say "prevent creation of branches with this pattern, except for these people", but then continue allowing pushing of commits still?

    The branch protection feature in GitHub should allow for nuanced control over both the creation of new branches and the ability to push to existing branches.

    By checking the "Restrict pushes that create matching branches" option and providing a branch name pattern, you can prevent the creation of new branches that match the pattern for everyone except the specified people, teams, or apps.

    The "Restrict who can push to matching branches" option, when checked, limits who can push to existing branches that match the pattern. If this is unchecked, then anyone with push access to the repository can push the branches that match the pattern, regardless of whether they are allowed to create them.

    In your case:

    Luiz asks in the comments:

    If I create a rule for a branch, for example: release_[0-9].[0-9]*, to prevent the creation of new branches but still allow all users to push to existing branches, how would be to set different users for "Restrict pushes that create matching branches" and "Restrict who can push to matching branches" since both are configured within the same block?

    I agree: currently, when you enable both "Restrict who can push to matching branches" and "Restrict pushes that create matching branches", the list of users or teams you specify applies to both pushing to existing branches and creating new branches that match the pattern.
    Unfortunately, GitHub does not allow you to set different users for these two options within the same branch protection rule.

    An alternative could be a GitHub Action that triggers on branch creation events. The action can check if the user who created the branch is authorized and delete the branch if not.
    However, this is a reactive approach that does not prevent the branch from being created: it only removes it afterward.

    Or, since you're using GitHub Enterprise, you have the option to implement pre-receive hooks. These hooks can enforce policies before the push is accepted by the server.

    The script would check if the branch being created matches the pattern and if the user is authorized.