Skip to content

Resolve "Developer cannot push to projects they create in groups" by allowing to set "Default branch protection" at the group level

What does this MR do?

Fixes #7583 (closed)

This MR replicates the current instance level setting "Default branch protection" to the group level, thereby allowing group owners to set this setting as per their discretion, rather than relying on the instance level setting on GitLab.com.

Screenshot_2020-02-24_at_11.26.53_AM

By setting this value to something like "No protection" or "Partially protected" Group owners can now allow developers to push to master branch of newly created projects in a group.

After the initial repo is set up, group owners have the flexibility to close down the repo from pushes to master branch by modifying the "Protected branch" settings of the project.

Changes

  • Move "default branch protection" to the group level (this is a replica of the instance level setting, and when not set explicitly, retains the value of the instance level setting")
  • Ability to change this group level setting via the API and the UI.
  • Branch protection checks now honour the new group level setting while checking for push access to the master branch, instead of honouring the instance level setting.

Video demo:

https://drive.google.com/file/d/1XwPRfoDsTyA5gj-9arCoaPNV24KIKVEP/view?usp=sharing

(This is a demo of figuring out the best way to solve this issue, and in the end it was decided that moving this setting to the group level was indeed the best way to solve this problem, so the idea mentioned in the video is what I've implemented)

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Manoj M J

Merge request reports