We store our git in TFS - Azure Devops.
We want to protect the main branch from push and deletion. push must be done with PR.
So we added a branch policy "Require a minimum number of reviewers".
The problem: users can still push to the branch.
So we updated the policy for "Bypass policies when pushing" and "Force push (rewrite history, delete branches and tags)" to "Deny".
But now the users cannot delete other branches..
Any idea how can we protect only the Main branch from deletion and push ?
Based on your description, it seemed that you had denied Force push (rewrite history, delete branches and tags) security settings on the repository level, so that all other branches were unable to be deleted as well.
Please check the security permission Force push (rewrite history, delete branches and tags) in All repositories and one affected repository for the users/groups. You may try and set the permission of Force push (rewrite history, delete branches and tags) in your repository Security tab back to Allow/Not Set for the users/groups and only adopt branch security restriction on the branch level.
Kindly refer to the security settings on the main branch like below. Thus, other branches will not be affected by the settings of the main branch and they could be still deleted or pushed.
You don't need the force push policy. Setting the require minimum number of reviewers in conjunction with denying the Bypass policies when pushing should give you what you want.
As long as you have these in place, your users cannot bypass the PR rule and if they try to do it with a force push will still receive an error
I find this missing feature in GitHub to be frustrating, so I'm documenting my work-around here to help the next person. Alternate, better work-arounds are welcome.
This question is not a duplicate of How to change the author of a commit in GitHub? ...because that question isn't clear if it is asking about how to rewrite the author of a few commits and the push those to github, or actually change the name under which the entire PR was created in the first place. And, the accepted answer to that question was a simple fix to the local .git/config file, which clearly will not solve the GitHub problem I'm talking about here.
At the top of a GitHub PR you'll see something like this:
username wants to merge 1 commit into base_branch from their_feature_branch
That username: how can we change that?
Example PR (chosen "at random" from GitHub, just to show the PR author line in the image below). Image:
Example use-cases:
The team-mate who opened this PR just left the company, and we'd like to commandeer (take over) and finish the PR for them.
Change of work-loads have necessitated you take over a partially-complete PR from another team-mate. How can you switch that PR to be in your name?
Assume that everyone has full push access to the whole repo, meaning that you can push/pull to/from each other's branches anyway.
Real-life example of why I want to know how to change the owner of an open PR
In 2020 a peer of mine opened a PR on a brand new branch that was intended to be worked on for 3 months until it had a ton of new features in it. Then, it would be merged. Peer reviews would occur on mini-PRs as they go into this separate, long-running, stand-alone branch.
The PR was initially opened with a "do not review" label, just to get the branch up so our CI (Continuous Integration) system would start to build it daily to ensure it wasn't broken. We would all then contribute to this branch with the understanding that the one person who opened it would be the "process owner" and walk the branch through all testing and processes until it gets merged back into the main branch.
My peer then left the company right after opening this PR. I immediately became the process owner and worked on the PR for 3 months and eventually merged it. That repo is set up by the maintainers to disable all types of merges except "squash merges" (see my comments under this question), so when it was merged, Github squashed all of the dozens of individual commits into one single huge commit and attached my peer's name (and keep in mind he hadn't been at the company for the last 3 months) to that commit, even though it was the commit that I had managed for nearly all of its 3 month lifetime.
git diff --shortstat 123456789abcd~..123456789abcd shows the following output:
164 files changed, 10360 insertions(+), 3013 deletions(-)
...meaning that commit had touched 164 files, added 10360 lines, and deleted 3013 lines. And guess what!? My peer's name is the name on all those changes, just because he opened the PR initially, instead of my name, even though a lot of that work was mine and I was the process owner of it. That's confusing, to say the least. I would have liked to have my name on all of those changed lines instead.
My answer here is therefore what I should have done, but didn't at the time, because I didn't know GitHub always uses the name of the person who opened the PR, and I didn't know how to change the owner of the PR. Now, I do know, and I have documented my workarounds in my answer.
What I actually did was option 1 from my answer, but what I should have done is option 2 from my answer.
Sometimes, an assignment gets passed off from one team member to another, or, a team member leaves a team. When this happens, it would be nice to "commandeer", or take over, their PR so that it becomes your PR. As far as I can tell, however, this isn't possible on GitHub yet.
On Phabricator (a paid alternative to GitHub, and originally an internal tool used at Facebook), this is as simple as clicking a button to "Commandeer Revision" (see old documentation here under "Take over another author's change"). This is known as "commandeering someone's diff", where "diff" here is the Phabricator-equivalent to a GitHub PR, or "Pull Request".
How to commandeer (take over) someone else's PR in GitHub
ie: how to change the owner of the open PR so it looks like you opened the PR, not them.
So, since GitHub doesn't allow commandeering a PR, here are some options:
Continue using their open PR, in which case their name, not yours, gets attached to the final, squashed-and-merged commit in the event you use the "Squash and merge" option to finish the PR. If they did the bulk of the work, that's fine. But, if you are taking over a PR and you are doing the bulk of the work, you'd probably like your name to be attached to the work. So, instead:
Just close their open PR and open your own.
To do option 1 above: just keep using their open PR, in which their name gets attached to the final, squashed merge commit:
Check out their branch locally
git fetch origin their_branch_name
git checkout their_branch_name
Optionally, rename your local copy of their branch to something you like
git branch -m new_branch_name
Set the upstream for this branch so that when you git push it will push to their remote branch name which is attached to their open PR:
git push --set-upstream origin new_branch_name:their_branch_name
Note: I learned the git push -u origin local_FROM_branch:remote_TO_branch syntax here: How can I push a local Git branch to a remote with a different name easily?
See also my own new answer to that question here.
Now, to push you can just call:
git push
And to pull from that branch, in case another team-mate pushes changes to it too, you can specify:
git pull origin their_branch_name
Now, whenever the PR is complete and reviewed, you can merge it via GitHub. If you choose the regular merge option you'll get credit for your commits. If you choose the "squash and merge" option, the original author, NOT you gets full credit for the entire merge. This is dumb and should be fixed by GitHub, but, that's how it is.
[My preference] Here's how to do option 2 above: just close their PR and open your own:
Go to the bottom of their PR and click "Close pull request": .
Check out their branch locally
git fetch origin their_branch_name
git checkout their_branch_name
Optionally, but recommended, rename your local copy of their branch to something you like.
git branch -m new_branch_name
Push this as a new branch to the remote origin on GitHub. This pushes to your remote branch and allows you to open a NEW PR under YOUR name on GitHub:
git push --set-upstream origin new_branch_name
# Note: if you didn't rename the branch to `new_branch_name` above,
# and it is therefore still called `their_branch_name` locally, just
# use `their_branch_name` here instead.
After pushing like that for the first time, GitHub will output a URL in the terminal where you pushed, which you can click on to open a new PR under your name. (If you don't have this feature, just go to Github.com and manually open up a PR there). Open a PR and voilá! It's now YOUR PR and you've just "commandeered" their PR!
Now, to push you can just call:
git push
And to pull from that branch, in case another team-mate pushes changes to it too, you can specify:
git pull origin new_branch_name
Now, when the PR is complete and reviewed, you can merge it on GitHub. If you choose the "squash and merge" option, your name will now be used for the final, single commit which gets merged to the base_branch.
See also:
How can I push a local Git branch to a remote with a different name easily?
[my own new answer I just added there] How can I push a local Git branch to a remote with a different name easily?
Just giving An example when this ability will be a necessary feature:
One of the PRs I Owned had state errors, that are not a part of the branch, but are localized to the PR:
>> git checkout -b new_name;
>> git push origin new_name;
>> opened new PR without errors.
The errors are not in GitHub per-se, but in some plugins and extensions we made for testing environment.
But I want the IT team to debug the state-corruption, so I would like to pass my PR onto them (the PR but not the code or the branch, obviously).
My commit button is not getting enabled after editing Readme file in github.
The reason why the commit button is not enabled is because you are trying to commit to the master branch of the repo, which is protected from making direct commits/push. Only those who have access to make direct commits to master can do that, and you might not have that access. Hence you need to select the second option there to create a new branch to make the commit and create a pull request to the master branch, or get access to directly contribute to that branch.
The branch protection is to ensure that collaborators don't directly push or make commits to the particular branch or delete it, and also allows enabling status checks or required reviews. You can read more about GitHub's branch protection here.
Background
I am using GitHub Enterprise.
I want to check unused branches in my repository, and ask owners of these unused branches to clean-up.
You can see "Your branches" (branches created by current user) on “Branches” page in GitHub. So I think GitHub might have information for who created a branch.
On the other hand, the result of GitHub REST API (https://developer.github.com/v3/git/refs/#get-a-reference) does not contain the creator of the specified branch.
Question
Is there’s any way to get the user who created a branch with GitHub API?
There is no real "ownership" associated to a branch with Git/GitHub.
As mentioned in the documentation, "Your branches" reference in a repository the branches you have push access to, not necessarily the ones you have "created".
The best you can do is, if you have access to a local clone, a simple git fetch, followed by:
git for-each-ref --format="%(committerdate) %09 %(refname:short) %09 %(authorname)" --sort=-committerdate refs/remotes/origin
That will list the remote branches from the most recent updated one to the oldest, with the author of the last commit on each branch.
But if you have to use GitHub API, then you would need to:
list the remote branches,
then for each one get the commit mentioned with the branch
You can then contact the committer of that most recent commit.
My repository: my-repo
Branch name: my-branch
User A: raised PR #123
Now, I checked out PR-123 using git fetch origin pull/123/head:userA-pr and checked out that new branch (userA-pr) to make some changes. Now, how can I push these changes back to PR #123?
How can I push these changes back to PR #123?
You cannot, since the all idea of a PR is to contribute to a repo you are not the owner of, to which you cannot contribute (push) directly to.
If you need to contribute to another repo (including one from which a PR was done), you need to:
fork their own repo (which seems to be possible since 2016), make your branch in it, and make a PR.
or (in your case) directly make a PR to their fork, as Chris Dodd adds in the comments.
Or you simply make a common branch (here userA-pr) in your repo and invite the other contributor to make PRs against that branch: see "Forking a fork of my repo in GitHub"