How to write protect a Stash git repo

If a Stash project grants write permission to all it's repositories, I don't believe it is possible to remove that access at the repo level, or at least not in Stash, as the hierarchical permission model only works when adding privileges, not removing them. Am I right?

If that is the case, then what is the best way of preventing write access at the git repo level - i.e. applied to the Stash-managed git repo - perhaps for a period of maintenance? I know that a pre-receive hook might prevent pushing, but is there an easier method, that might even stop pulls and clones? BTW I don't much like the Stack Control recommendation of using chmod to do this because it  might be difficult to revert to the previous settings when chmod'ing the whole repo directory.

1 answer

1 accepted

0 votes
Answer accepted

Hi John,

To prevent write access, you could create a Branch Permission that matches against * and restricts updates to just yourself or potentially an empty group. That will block any tag or branch update, effectively making it a read-only repository.

To prevent read access, you'd need to actually remove the read permission. One way to do this without messing with your project permissions is to create a "Read-only" project and physically move the repository into it, and then move it back when you're done with the maintenance.



Hi Tim, Thanks for these suggestions - I had half thought of the branch idea after posting the question, but the second may be better if I wanted to prevent any pull or clone as well since existing urls would be wrong until I put it back again. This certainly would have been best for the particular circumstance I found myself in that prompted the question - I was using BFG to remove a 1.4Gb file that had been unwittingly committed and pushed - the removal was successful! Regards, John

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Mar 14, 2019 in Bitbucket Pipelines

Building a Bitbucket Pipe as a casual coder :  #!/bin/bash source "$(dirname "$0")/" enable_debug extra_args="" if [[ "${DEBUG}" == "true" ]]; then extra_args="--verbose" fi # mandatory variables R...

251 views 0 12
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you