How to override Project Level Branch Security

Question

Is there a simple way to manage security at a project level and override it at a repo level.

For example, we have a project called UPN and it has 100 repositories in it.  At a project level we setup branch security to say

Branch Name : Master

Deletion :  (BLANK)

Rewrite History : (BLANK)

Changes w/o Pull Request : (BLANK)

All Changes: our-developer-group

This is a huge time saver as we don't have to manage security for each repo.  However we commonly hit scenarios where we might want a repository to temporarily bend the rules.  For example we might want to restrict the changes for repo-x to a smaller group during a certain period or we might want to enable Rewrite history to allow a one time rebase.

So in repo-x I added another branch permission on Master

Branch Name : Master

Deletion :  (BLANK)

Rewrite History : (BLANK)

Changes w/o Pull Request : (BLANK)

All Changes: our-special-user-group

It looks like the security there is additive instead of overriding.  Is there a means to override security without having to move the repo and or changing it at the entire project level?

Chris Idema · Answer

It worked!
I had to enable branch deletion in order to allow branch creation!

I had an empty repository and we only allow merge commits in the master branch, that means that you cannot push an initial commit to the master as there is no master.

In project settings it had rewriting history and deletion disallowed. I had to create a new restriction that had to check both allowing rewriting AND deletion in order to push the master branch.

jorge_costa · Answer

nah its crazy, this should totally be reviewed and implemented properly. repo owners should totally be able to override project permissions if they choose to

Russell Schultz - gmail · Answer

This is old, but I had to struggle with it this evening.

It is additive, but the only way to loosen permissions (at least with our corporate bitbucket server) was to add a new permission to the repository that copied the project branch permission, but had an exception for the users you wanted to allow the action to.

Non-intuitive, but it worked.