Feature Request - Separate Unarchive Permission from Archive

Problem to solve

Currently, the archive_project custom permission controls both archiving and unarchiving a project as a single action. There is no way to allow a user to archive a project while preventing them from unarchiving it.

This creates a governance gap for customers who follow an archive → backup → delete workflow for inactive repositories. Project Owners can unarchive a project during the deletion retention window and make changes after a backup has been taken, resulting in data loss.

On GitLab.com (SaaS), this risk is higher since Owner is the highest-privileged role available — there is no instance admin above them to enforce restrictions.

Proposal

Introduce a separate unarchive_project permission (or an instance/group-level setting such as "Restrict unarchive to administrators") so that administrators can prevent Owners from unarchiving projects.

This would complement the existing Restrict project deletion to administrators setting.

Intended users

• Instance administrators managing project lifecycle and governance
• Project Owners in regulated industries with strict backup/deletion workflows

Customer Interest

• Subscription: GitLab Premium
• Product: self-managed
• Link to request: ZD #709442 (Internal)
• Priority: customer priority3
• Labels: self-managed
• Why interested: Customer follows an archive → backup → delete workflow for inactive repositories. Owners can currently unarchive a project during the deletion retention window and make changes after backup, causing data loss. The customer would like the ability to restrict unarchive to administrators only, similar to how project deletion can be restricted.