Separate permissions for create vs. push on protected branches
<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Close this issue](https://contributors.gitlab.com/manage-issue?action=close&projectId=278964&issueIid=3198) </details> <!--IssueSummary end--> ### Description We want to ensure code reviews take place on all "protected" branches in our repository, which for us means `master`, `develop` and `release/*`. To achieve this we have protect those two branches and that wildcard. We only allow fast-forward merging into these protected branches and we create merge requests requiring approval of one other developer to effect those merges. This works fine for the existing branches (master and develop). However only allowing merges (no pushes) means we can't create new `release/*` branches. We currently have two options then: 1. Remove the protected branch wildcard and configure this for each and every `release/foo` branch that we create 2. Temporarily allow pushes to release branches whenever we want to create one (then disable afterwards). Neither of those solutions is very elegant and both require work we'd rather avoid. ### Proposal Ideally we'd be able to prevent push to existing branches but allow it for branch creation. So if the `release/foo` branch already existed then we could only get new code into that branch via a merge request (i.e. requires code review). However it would still be possible to create the as yet non-existent `release/bar` branch simply by creating the branch on a local developer's machine and pushing to gitlab. ### Links / references See [help on protected branches](https://ato-git-nrgs.gtoffice.lan/help/user/project/protected_branches.md#protected-branches). #### Use cases This feature would be for teams that want to enforce code reviews via merge requests on all code that gets included in protected branches. ### Feature checklist Make sure these are completed before closing the issue, with a link to the relevant commit. - [ ] [Feature assurance](https://about.gitlab.com/handbook/product/#feature-assurance) - [ ] Documentation - [ ] Added to [features.yml](https://gitlab.com/gitlab-com/www-gitlab-com/blob/master/data/features.yml)
issue