would like to only allow specific users/groups to create branches of type release/

Question

(Stash v3.10.2)

We have a need to prevent the general population from creating new branches of the type "release/".

(but still allowing them to merge to and do pull request to these branches)

Is there a way to do this with the current stash product?

It would be nice if the plugins/servlet/create-branch page would prevent the user from selecting branch type of Release based on permissions, that then would need to be added to the plugins/servlet/branch-permissions page.

In lieu of that, I guess someone has to write a plugin to accomplish this, assuming there is a hook that is available in regards to the create-branch page?

guy moore · Answer

thanks very much @Michael Heemskerk, for the full explanation and the snippet of code.

Look like I'll have to write an event listener plugin to prevent inadvertent release/ branch creations.

(we do implement pull requests and approvers, but gatekeepers would complicate matters where there are merge conflicts downstream on other release branches. We want just the developers to handle those as they are the best to figure it out. Plus developers do "preemptive merges" to downstream release branches to head off any rolling automerges that end up in a merge conflict. That would stop the workflow for everyone for a period of time until they were fixed.)

Michael Heemskerk · Answer

As @Mike Friedrich suggested, you can use branch permissions to limit who can make any change to a release branch.

You can limit who can write to your release branches, but this will also prevent people from merging pull requests into the release branch. You'd have to adopt a 'gatekeeper' workflow where one of the people who has write access to the release branch needs to be added to any pull request targeting the release branch. That person then performs the merge when the other reviewers have approved the pull request.

An alternative is to restrict your release branches to 'Prevent changes without a pull request` and 'Prevent branch deletion', but this won't stop people from creating new release branches (either from the create-branch page or by pushing them).

In lieu of that, I guess someone has to write a plugin to accomplish this, assuming there is a hook that is available in regards to the create-branch page?

There is a hook of sorts that you can use to restrict branch creation from the create-branch page. If you add an event listener for the BranchCreationRequestedEvent, you can then cancel the request.

@EventListener
public void onBranchCreationRequested(BranchCreationRequestedEvent event) {
    if (..your logic here...) {
    event.cancel(i18nService.createKeyedMessage("your.message.key", event.getBranch().getDisplayId()));
    }
}

This will won't prevent people from pushing up new release branches though. If you also want to block those, you'll have to create a pre-receive hook with similar logic.

However, adopting a gatekeeper workflow does the trick to and adds a more oversight to what goes into your release branches.

guy moore · Answer

yes, I can prevent people from creating branches, but then that also prevents them from merging code and pull requests to the branch in question, hence that does not satisfy my requirement on my line #2 in parenthesis above.)