Disable merge access but have approve access

[leovipin1]

Select Topic Area

Question

Body

Hi Team,

I want to know if there is a way that a collaborator has only code-review approve access but not merge access i.e. if any user has submitted a PR and the setting approval required is enabled and a collaborator has approved the PR review, but the merge button is disabled and only the admin of the repository or code owner of the file can merge the PR.

[himanshu-03]

Yes, it is possible to grant a collaborator code-review approve access but not merge access. This can be done by using protected branches. Protected branches are branches that have additional restrictions on them, such as requiring a certain number of approvals before a pull request can be merged.

To create a protected branch, go to the Settings tab of your repository and click on Branches. Click on the New branch button and enter a name for your branch. Under Branch protection rules, check the box next to Require pull request reviews before merging. You can also specify how many approvals are required before a pull request can be merged.

Once you have created a protected branch, you can add collaborators to the repository. When a collaborator creates a pull request to the protected branch, it will need to be approved by the required number of people before it can be merged. The collaborator who created the pull request will not be able to merge it themselves, even if they are the only one who has approved it.

Only users with the Maintain permission on the repository will be able to merge pull requests to protected branches. This includes the repository owner and any other users who have been explicitly granted the Maintain permission.

Here are the steps to grant a collaborator code-review approve access but not merge access:

1. Create a protected branch.
2. Add the collaborator to the repository.
3. When the collaborator creates a pull request to the protected branch, it will need to be approved by the required number of people before it can be merged.
4. Only users with the Maintain permission on the repository will be able to merge pull requests to protected branches.

This approach can be useful for projects where you want to ensure that all changes to the code are reviewed by multiple people before being merged. It can also be useful for projects where you want to limit the number of people who can merge changes to the code.

[leovipin1]

Hi Himanshu,

This did not work, the collaborator was still able to approve and merge.

[himanshu-03]

Try configuring this in the branch protection rule. Ig this shouldn't let the collaborator merge and changes without being reviewed by the code owner (i.e. repo owner)

You need to tick the option Require review from code owners

[leovipin1]

Hi Himanshu,

Yes, I have enabled the require review by code owners. Just wanted to tell you that the PR is being raised by the code owner itself.

[himanshu-03]

If you have selected that option, then without code owner's approval the branch cannot be merged by any collaborator!

[himanshu-03]

Try enabling this option as well!

[himanshu-03]

Other than this I dont think GitHub provides for any options!

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬