124

I have a single repository in which I have two user groups:

  • Administrators
  • HTML/UI Developers

I do not wish to give read/write access of my master branch to my HTML developers as they do not need to work on it and should not be misusing the core code.

Though they need to work on their own branch ui-developers. How do I do this on Git?

P.S.: I am using Bitbucket


I had posted this question when I was extremely new to coding and Git. After two years of experience, I now know that Git doesn't allow to restrict READ access for any particular branch. But services like Bitbucket, GitLab, and GitHub allow you to put write and merge restrictions to branches.

Also, I shifted to GitLab six months back :)

6
  • 6
    Simplest is to just tell them what you want them to do. Aug 10, 2016 at 5:02
  • 29
    @JohnZwinck Would prefer 'restricting' it in stead of just relying on everyone to follow the instructions Aug 10, 2016 at 8:21
  • Did you ever manage to do this? I need to do the same
    – Gotts
    Sep 15, 2019 at 11:58
  • 3
    You can't control read access to your project/group members (in this case HTML/UI developers) but you can certainly have write control on master. You can protect master by not allowing to commit and allow only Maintainers or Maintainers /Developers to Merge request to master. That way every developer with their own ui-developers branch need to review code before merging to master when required.
    – user85
    Aug 12, 2020 at 10:53
  • 1
    So how to restrict WRITE access (push)?
    – Abdo
    Jun 20, 2021 at 8:37

6 Answers 6

185

Git itself does not have such feature, but many hosting providers do. This is generally known as branch protection. There is no way to prevent read access as far as I know.

Using Bitbucket

Bitbucket allows a lot of customization for the actions to prevent by branch protection. To protect a branch:

  1. Go to a repository in a project.

  2. Choose SettingsBranch permissions.

  3. Click Add permission.

  4. In the Branches field, select either Branch name, Branch pattern, or Branching model.

  • Branch name - select an existing branch by name.

  • Branch pattern - specify a branch using branch pattern syntax for matching branch names.

  • Branching model - select the branch type to restrict access to.

  1. Select the type of actions you want to prevent.
  • Branch deletion - prevents branch and tag deletion.

  • Rewriting history - prevents history rewrites on the specified branch(es) - for example by a force push or rebase.

  • Changes without a pull request - prevents pushing changes directly to the specified branch(es); changes are allowed only with a pull request.

  • All modifications - prevents pushes to the specified branch(es) and restricts creating new branches matching the specified branch(es) or pattern.

  1. Optional: Add exemptions for any of the selected restrictions. Adding a user or group as an exemption means that it will not apply to them. This is not required; not adding any exemptions means the restriction will apply to everyone.

  2. Click Create to finish.

Source

Using GitHub

A repository can have multiple protected branch rules that affect the same branches.

Protected branches are available only in public repositories with GitHub Free.

Protected branch in GitHub can be configured to require:

  • pushes to be made via pull requests and reviewed before being merged,

  • other branches to pass status check before being merged,

  • commits to be signed,

  • history to be linear,

  • that the above rules are enforced even for administrators,

  • that pushes come from specific people, teams or applications,

Force pushes and deletions can be allowed independently.

To protect a branch:

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Settings.

  3. In the left menu, click Branches.

  4. Next to "Branch protection rules", click Add rule.

  5. Under "Branch name pattern", type the branch name or pattern you want to protect (Impacted branches are listed and counted).

  6. Configure specific branch rule settings if needed.

  7. Click Create or Save changes.

Source

Using GitLab

In GitLab, protecting a branch does the following:

  • it prevents its creation, if not already created, from everybody except users with Master permission
  • it prevents pushes from everybody except users with Master permission
  • it prevents anyone from force pushing to the branch
  • it prevents anyone from deleting the branch

To protect the branch:

  1. Navigate to the main page of the project.

  2. In the upper right corner, click the settings wheel and select Protected branches.

  3. From the Branch dropdown menu, select the branch you want to protect and click Protect.

  4. Once done, the protected branch will appear in the "Already protected" list.

You can then allow some access to users with developer rights by checking "Developers can merge" or "Developers can push"

Source

4
  • The steps for GitHub seems to have updated since you answered. Can you please update your answer as per the latest update. May 5, 2020 at 15:57
  • I was curious about "Branching model" in Bitbucket -- it seems similar to "branching pattern" in that it lets you do restrictions to all branches named "feature/", "development", and so on. confluence.atlassian.com/bitbucketserver/…
    – Noumenon
    Jul 24, 2020 at 20:00
  • 1
    On GitHub: "Protected branches are available to Pro, Team, and Enterprise users"
    – Rafs
    May 8, 2021 at 15:50
  • Don't know where you got that quote, but this is what GitHub website says: "Protected branches are available in public repositories with GitHub Free and GitHub Free for organizations, and in public and private repositories with GitHub Pro, GitHub Team, GitHub Enterprise Cloud, and GitHub Enterprise Server."
    – 1615903
    May 10, 2021 at 4:10
7

Actually for Bitbucket, you can add a branch permission for Master only to block everything:

Enter image description here

And then for feature, you do allow writing to feature branches:

Enter image description here

I have tested it and I am not allowed to push directly to the Master branch.

6

In Git itself you can use the "pre-receive" hook in the server to protect for writing in a branch to some user.

Using this hook you can apply your restriction policies for each file in the push.

Here you can find an example.

3

Addition to @1615903's answer, you can protect a branch in Azure DevOps like below:

Using Azure DevOps

In Azure DevOps, protecting a branch with security permissions and policies which allow you can do the following:

  • Add or remove users and groups to a specific branch.
  • Declare a minimum number of reviewers for pull requests.
  • Automatically include code reviewers
  • Automatically check linked work items is required or optional
  • Check for comment resolution
  • Enforce a merge strategy (no-fast-forward or squash)
  • Build validation

and more detailed information on the documentation page.

To protect the branch:

  1. Select ReposBranches in the project's main page to open the Branches.
  2. Locate your branch on the page in which all branches are listed.
  3. Select the ... button. Then select Branch policies or Branch security from the context menu.
  4. Once you have done, select Save changes to apply your new policy configuration.
1
  • All of the buttons on the master branch policies page are disabled even though I am the one and only admin.
    – Mike
    Feb 16, 2021 at 21:27
2

There is a lot of information here that is factually incorrect today.

Protected branches are not "only" limited to GitHub public branches. Can you restrict read access to a branch? Yes! You can restrict read access using key management, namely SSH keys. We do it all of the time given we have contracting software developers working on projects that don’t work for us.

Essentially if you don't authenticate with the issued SSH key, you can’t access (read/write) the branch. We later got smarter and started asking each developer to share their SSH key with us and we developed a script now (for Bitbucket) that checks against all SSH keys before granting access.

2
  • 1
    Could you explain a bit more how you do it?
    – user276648
    Sep 16, 2021 at 1:40
  • What kind of SSH key? Private or public key? Can you add it? (But without "Edit:", "Update:", or similar - the answer should appear as if it was written today). Dec 6, 2021 at 20:39
1

For Bitbucket, here it is.

First get to your repository settings.

Enter image description here

Then branch permissions.

Select branch permissions

Finally, restrict the way you want.

Set branch permissions

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.