Best practice to give access to external programmer without letting him modify our branches.

[futile_studio]

We have a private repository and we want an external programmer to contribute with his code to our project. 

We don't want him to accidentally mess our code so I would like to allow him to clone the repository and when he have something to push, we have to approve it before we merge it into the master. He can't merge his branch into any our branches. 

How can we do that? How do yo do that?

[Deleted user]

For this, you would go to Settings -> User and Group Access, then give the external programmer READ ACCESS only. They could then clone the repo and make a 'pull request' but they could not actually merge a pull request into your codebase. 

https://confluence.atlassian.com/bitbucketserver/using-repository-permissions-776639771.html

[Julius Davies _bit-booster_com_]

Good advice from @[deleted] but there's one extra step:

The external developer should fork the repo first, and then clone from their fork.

p.s.  Is this for Bitbucket Cloud or Bitbucket Server?  Essentially the same mechanism for both (and I think the fork button is in the same place in the web UI and looks pretty similar), but there can be subtle differences.

[Caterina Curti]

Hi @futile_studio,

As suggested by @Julius Davies _bit-booster_com_ (thank you!), using a Forking Workflow is a valid option. In this case the external programmer will be working on an entirely separated repository. It will still be possible to easily merge the changes back to the original repository.

If, instead, you want to external programmer to work directly on the main repository, you can set up branch permissions to control which branches she can access. This is available for both Bitbucket Server and Cloud:

- Branch permissions - Bitbucket Server

- Branch permissions - Bitbucket Cloud

This works well if the branch names follow a well defined naming convention. Usually in this case you would also set up merge checks.

Cheers,

Caterina - Atlassian