Allow setup for all protected branches

[rossbeehler]

We have a rich structure of groups/projects with a variety of branching strategies. We'd like to enforce merge_access_level and push_access_level across all existing protected branches for a project/repo, but the current syntax only allows you to specify a name with or without a wildcard. It would be nice if GitLabForm had a way to set branch settings for all protected branches in a repo, even if they are named master, main, dev, develop, qa, uat, testing, etc.

Proposed syntax

config_version: 2

gitlab:
  url: <url>

projects_and_groups:
  <group/project clause>:
    ...
    protected_branches:
      push_access_level: ...
      merge_access_level: ...
      <other branch settings>
    ...

[amimas]

I believe the current syntax already allows using wild card pattern for branch names and set desired configs.

[amimas]

https://gitlabform.github.io/gitlabform/reference/protected_branches/

[gdubicki]

I believe the current syntax already allows using wild card pattern for branch names and set desired configs.

Unfortunately GitLab supports just plain wildcards with just *, so you cannot enter a regexp there that would cover branches like master, main, dev etc., @amimas.

@rossbeehler: I would use YAML anchors to shorten the config here:

projects_and_groups:
  <group/project clause>:
    (...)
    master: &protected_branch_permissions
      push_access_level: (...)
      merge_access_level: (...)
      (...)
    main: *protected_branch_permissions
    dev: *protected_branch_permissions
    develop: *protected_branch_permissions
    (...)

As GitLabForm skips missing branches by default (unless you do --strict) you can apply such config to all your repos, even if then don't contain some of them.

[amimas]

Yes, you're right. I was thinking of using global wildcard with just *. But this will make every single branches as protected.

Yaml anchor is a good way to address this. Another option might be setting these branch protection at the group level. That way each special branch name and config needs to be listed once and it'll be applied to all projects under that group. Please correct me if I'm wrong.

[rossbeehler]

@gdubicki - thanks for the YAML anchor workaround. Trying to think through the risk of not being able to cover the multitude of names teams/groups could hash up that simply wouldn't be visible in GitLabForm config. Maybe at the top-level we should only be so prescriptive for master and main, and if teams workaround it, then it's on them.

@amimas - I'm not seeing the ability in the GitLab UIs to set group-level protected branch names/settings. Or are you saying that would be done in GitLabForm's config (it's actually a project level setting but done at the group level)? If that's what you mean, then I wholeheartedly agree.

[amimas]

Or are you saying that would be done in GitLabForm's config (it's actually a project level setting but done at the group level)?

Yes. That's what I meant. Creating a gitlabform config that will apply the specified branch protection to all projects.

projects_and_groups:
  group_1/*:
    branches:
      # Keep this branch unprotected
      develop:
        protected: false
      # Allow merging by developers, but no direct commits
      main:
        protected: true
        push_access_level: no access
        merge_access_level: developer
        unprotect_access_level: maintainer
      # Disallow any changes to this branch
      special_protected_branch:
        protected: true
        push_access_level: no access
        merge_access_level: no access
        unprotect_access_level: maintainer
      # Protect branches with names matching wildcards
      '*-some-name-suffix':
        protected: true
        push_access_level: no access
        merge_access_level: developer
        unprotect_access_level: maintainer
      # Protect the branch but allow force pushes
      allow_to_force_push:
        protected: true
        push_access_level: no access
        merge_access_level: developer
        unprotect_access_level: maintainer
        allow_force_push: true

The above example is taken from the docs link I posted above. Only tweak is the wildcard used at the group (group_1).

[rossbeehler]

Note that I did some testing with this approach, and it produces a little bit of a mess. Note all the Branch was deleted. statements, which isn't actually true, as those are just branches that didn't exist in my test project/repo.

Is this expected? I would have hoped that it only applied those settings to existing branches.

[amimas]

I believe that's a default behaviour by Gitlab. It allows setting branch protection for a branch that doesn't exist yet. I agree the message in the UI maybe slightly misleading.

[amimas]

I would have hoped that it only applied those settings to existing branches.

This might be a separate feature request for gitlabform.