feat(org): org-level push policy enforced in the pre-receive hook (#727)

Adds a single per-org push policy that cascades to every repo of the org and is
enforced in the pre-receive hook:

- Branch/tag name conventions (glob) — a pushed ref name must match. Fail-closed.
- Mandatory secret-scanning block-on-push — org can force secret blocking that a
  repo cannot disable (overrides the per-repo scanner config in the orchestrator).
- Max pushed-file size — rejects a tip tree containing a blob over the limit.
- Blocked file-path patterns — rejects pushes changing matching paths (reuses
  pull_service.CheckFileProtection).

The two content checks (blocked paths, max size) FAIL OPEN on any error so a
policy/parsing bug can never wedge all pushes; naming is fail-closed.

- models/git/org_push_policy.go: OrgPushPolicy model + CRUD + matchers +
  GetOrgPushPolicyForRepo. Migration 364.
- API: GET/PATCH/DELETE /orgs/{org}/push_policy (routers/api/v1/org/push_policy.go,
  DTOs in modules/structs/org_push_policy.go, wired in api.go).
- Enforcement: routers/private/hook_pre_receive.go (branch: naming + blocked paths
  + max size; tag: naming) and services/security/orchestrator.go (secret mandate).

Deferred: a repo-facing read-only view of the org push policy (it is an org-wide
config, not per-repo overlay rules; readable via the API for now).

Stacked on #729/#728 for migration ordering (this = 364). Swagger annotations
omitted (can't regenerate without the toolchain).

Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here.
Hand-verified: gofmt (tabs, no blank-in-block), escape sequences in the ls-tree
parser, imports used, migration contiguous (364), fail-open on content checks.

Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT

CHANGELOG.md

@@ -6,6 +6,7 @@
 - Org branch protection: repositories now show the inherited organization rules read-only in their Branch Protection settings, with an expandable detail (direct push, force-push, branch deletion, merge restrictions, required approvals, status checks, protected files, and whitelisted teams) — like GitHub surfaces org rulesets in a repo (#727)
 - Org branch protection: org-level rules can now also protect against branch deletion (`enable_delete` + delete allowlist teams), mirroring the per-repo delete allowlist (#727)
 - Org-level tag protection: protect tag patterns org-wide (e.g. `v*`) with a team allowlist, layered on top of each repo's own protected tags — a tag is controllable only if allowed at both levels (fail-closed). API at `/orgs/{org}/tag_protections`; enforced at the git push/delete hook and the release create/delete paths; shown read-only in the repo Tag settings (#727)
+- Org-level push policy: one policy per org, enforced in the pre-receive hook across all its repositories — branch/tag name conventions (glob), a mandatory secret-scanning block-on-push that repos cannot disable, a max pushed-file size, and blocked file-path patterns. API at `/orgs/{org}/push_policy`. Naming is fail-closed; the content checks (blocked paths, max size) fail open on error so a policy bug can never block every push (#727)
 - Code security scanner: pattern-based detection of SQL injection, XSS, command injection, path traversal, insecure deserialization, hardcoded credentials, and weak cryptography across Go/PHP/Python/JS/TS (#552)
 - Cascade merge: auto-create PRs to downstream branches after merge with configurable rules per repo (#460)
 - Issue status presets: 4 built-in templates (default, software-development, support-tickets, bug-tracking) with API + web UI (#507)

models/git/org_push_policy.go

@@ -0,0 +1,130 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/glob"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgPushPolicy is a single org-wide policy enforced in the pre-receive hook on
+// every repository of the organization. Unlike the branch/tag rulesets there is at
+// most one policy per org. Empty pattern / zero fields mean "no constraint". See #727.
+type OrgPushPolicy struct {
+	ID                  int64              `xorm:"pk autoincr"`
+	OrgID               int64              `xorm:"UNIQUE NOT NULL"`
+	BranchNamePattern   string             `xorm:"TEXT"`
+	TagNamePattern      string             `xorm:"TEXT"`
+	RequireSecretBlock  bool               `xorm:"NOT NULL DEFAULT false"`
+	MaxFileSize         int64              `xorm:"NOT NULL DEFAULT 0"`
+	BlockedFilePatterns string             `xorm:"TEXT"`
+	CreatedUnix         timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix         timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgPushPolicy))
+}
+
+// nameMatchesPattern reports whether name satisfies a glob pattern. An empty pattern
+// imposes no constraint; an invalid pattern fails open (no constraint) so a
+// misconfigured policy never blocks all pushes.
+func nameMatchesPattern(pattern, name string) bool {
+	pattern = strings.TrimSpace(pattern)
+	if pattern == "" {
+		return true
+	}
+	g, err := glob.Compile(pattern, '/')
+	if err != nil {
+		log.Warn("Invalid org push policy name pattern %q: %v", pattern, err)
+		return true
+	}
+	return g.Match(name)
+}
+
+// BranchNameAllowed reports whether a branch name satisfies the naming policy.
+func (p *OrgPushPolicy) BranchNameAllowed(name string) bool {
+	return nameMatchesPattern(p.BranchNamePattern, name)
+}
+
+// TagNameAllowed reports whether a tag name satisfies the naming policy.
+func (p *OrgPushPolicy) TagNameAllowed(name string) bool {
+	return nameMatchesPattern(p.TagNamePattern, name)
+}
+
+// BlockedFileGlobs parses the ';'-separated blocked file pattern list.
+func (p *OrgPushPolicy) BlockedFileGlobs() []glob.Glob {
+	var out []glob.Glob
+	for _, expr := range strings.Split(p.BlockedFilePatterns, ";") {
+		expr = strings.TrimSpace(strings.ToLower(expr))
+		if expr == "" {
+			continue
+		}
+		if g, err := glob.Compile(expr, '.', '/'); err == nil {
+			out = append(out, g)
+		} else {
+			log.Warn("Invalid org push policy blocked file pattern %q: %v", expr, err)
+		}
+	}
+	return out
+}
+
+// GetOrgPushPolicy returns the org's push policy, or nil if none is configured.
+func GetOrgPushPolicy(ctx context.Context, orgID int64) (*OrgPushPolicy, error) {
+	policy, exist, err := db.Get[OrgPushPolicy](ctx, builder.Eq{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return policy, nil
+}
+
+// GetOrgPushPolicyForRepo returns the push policy of the repo's owning organization,
+// or nil if the owner is not an organization or has no policy.
+func GetOrgPushPolicyForRepo(ctx context.Context, repo *repo_model.Repository) (*OrgPushPolicy, error) {
+	owner, err := user_model.GetUserByID(ctx, repo.OwnerID)
+	if err != nil {
+		return nil, err
+	}
+	if !owner.IsOrganization() {
+		return nil, nil //nolint:nilnil
+	}
+	return GetOrgPushPolicy(ctx, owner.ID)
+}
+
+// UpsertOrgPushPolicy creates or updates the single push policy for an org.
+func UpsertOrgPushPolicy(ctx context.Context, policy *OrgPushPolicy) error {
+	existing, err := GetOrgPushPolicy(ctx, policy.OrgID)
+	if err != nil {
+		return err
+	}
+	if existing == nil {
+		if _, err := db.GetEngine(ctx).Insert(policy); err != nil {
+			return fmt.Errorf("Insert OrgPushPolicy: %v", err)
+		}
+		return nil
+	}
+	policy.ID = existing.ID
+	if _, err := db.GetEngine(ctx).ID(existing.ID).AllCols().Update(policy); err != nil {
+		return fmt.Errorf("Update OrgPushPolicy: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgPushPolicy removes an org's push policy.
+func DeleteOrgPushPolicy(ctx context.Context, orgID int64) error {
+	_, err := db.GetEngine(ctx).Where("org_id = ?", orgID).Delete(new(OrgPushPolicy))
+	return err
+}

models/migrations/migrations.go

@@ -441,6 +441,7 @@ func prepareMigrationTasks() []*migration {
 		newMigration(361, "Add cascade merge rule table", v1_27.AddCascadeMergeRuleTable),
 		newMigration(362, "Add delete allowlist to org protected branch", v1_27.AddDeleteAllowlistToOrgProtectedBranch),
 		newMigration(363, "Add org protected tag table", v1_27.AddOrgProtectedTagTable),
+		newMigration(364, "Add org push policy table", v1_27.AddOrgPushPolicyTable),
 	}
 	return preparedMigrations
 }

models/migrations/v1_27/v365.go

@@ -0,0 +1,27 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgPushPolicyTable creates the org-level push policy table (one row per org),
+// enforced in the pre-receive hook across all repositories of the org. See #727.
+func AddOrgPushPolicyTable(x *xorm.Engine) error {
+	type OrgPushPolicy struct {
+		ID                  int64              `xorm:"pk autoincr"`
+		OrgID               int64              `xorm:"UNIQUE NOT NULL"`
+		BranchNamePattern   string             `xorm:"TEXT"`
+		TagNamePattern      string             `xorm:"TEXT"`
+		RequireSecretBlock  bool               `xorm:"NOT NULL DEFAULT false"`
+		MaxFileSize         int64              `xorm:"NOT NULL DEFAULT 0"`
+		BlockedFilePatterns string             `xorm:"TEXT"`
+		CreatedUnix         timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix         timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgPushPolicy))
+}

modules/structs/org_push_policy.go

@@ -0,0 +1,30 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+import "time"
+
+// OrgPushPolicy represents an organization's push policy (one per org)
+type OrgPushPolicy struct {
+	OrgID               int64  `json:"org_id"`
+	BranchNamePattern   string `json:"branch_name_pattern"`
+	TagNamePattern      string `json:"tag_name_pattern"`
+	RequireSecretBlock  bool   `json:"require_secret_block"`
+	MaxFileSize         int64  `json:"max_file_size"`
+	BlockedFilePatterns string `json:"blocked_file_patterns"`
+	// swagger:strfmt date-time
+	Created time.Time `json:"created_at"`
+	// swagger:strfmt date-time
+	Updated time.Time `json:"updated_at"`
+}
+
+// EditOrgPushPolicyOption options for editing an organization's push policy. Only
+// fields that are set will be changed.
+type EditOrgPushPolicyOption struct {
+	BranchNamePattern   *string `json:"branch_name_pattern"`
+	TagNamePattern      *string `json:"tag_name_pattern"`
+	RequireSecretBlock  *bool   `json:"require_secret_block"`
+	MaxFileSize         *int64  `json:"max_file_size"`
+	BlockedFilePatterns *string `json:"blocked_file_patterns"`
+}

routers/api/v1/api.go

@@ -1833,6 +1833,12 @@ func Routes() *web.Router {
 				})
 			}, reqToken(), reqOrgOwnership())
 
+			m.Group("/push_policy", func() {
+				m.Combo("").Get(org.GetOrgPushPolicy).
+					Patch(bind(api.EditOrgPushPolicyOption{}), org.EditOrgPushPolicy).
+					Delete(org.DeleteOrgPushPolicy)
+			}, reqToken(), reqOrgOwnership())
+
 			m.Group("/blocks", func() {
 				m.Get("", org.ListBlocks)
 				m.Group("/{username}", func() {

routers/api/v1/org/push_policy.go

@@ -0,0 +1,88 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package org
+
+import (
+	"net/http"
+
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
+	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/web"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// toAPIOrgPushPolicy converts the model to its API representation. A nil policy is
+// rendered as an all-empty policy so clients always get a consistent shape.
+func toAPIOrgPushPolicy(policy *git_model.OrgPushPolicy, orgID int64) *api.OrgPushPolicy {
+	if policy == nil {
+		return &api.OrgPushPolicy{OrgID: orgID}
+	}
+	return &api.OrgPushPolicy{
+		OrgID:               policy.OrgID,
+		BranchNamePattern:   policy.BranchNamePattern,
+		TagNamePattern:      policy.TagNamePattern,
+		RequireSecretBlock:  policy.RequireSecretBlock,
+		MaxFileSize:         policy.MaxFileSize,
+		BlockedFilePatterns: policy.BlockedFilePatterns,
+		Created:             policy.CreatedUnix.AsTime(),
+		Updated:             policy.UpdatedUnix.AsTime(),
+	}
+}
+
+// GetOrgPushPolicy get the organization's push policy
+func GetOrgPushPolicy(ctx *context.APIContext) {
+	orgID := ctx.Org.Organization.ID
+	policy, err := git_model.GetOrgPushPolicy(ctx, orgID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgPushPolicy(policy, orgID))
+}
+
+// EditOrgPushPolicy create or update the organization's push policy
+func EditOrgPushPolicy(ctx *context.APIContext) {
+	form := web.GetForm(ctx).(*api.EditOrgPushPolicyOption)
+	orgID := ctx.Org.Organization.ID
+
+	policy, err := git_model.GetOrgPushPolicy(ctx, orgID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if policy == nil {
+		policy = &git_model.OrgPushPolicy{OrgID: orgID}
+	}
+
+	if form.BranchNamePattern != nil {
+		policy.BranchNamePattern = *form.BranchNamePattern
+	}
+	if form.TagNamePattern != nil {
+		policy.TagNamePattern = *form.TagNamePattern
+	}
+	if form.RequireSecretBlock != nil {
+		policy.RequireSecretBlock = *form.RequireSecretBlock
+	}
+	if form.MaxFileSize != nil {
+		policy.MaxFileSize = *form.MaxFileSize
+	}
+	if form.BlockedFilePatterns != nil {
+		policy.BlockedFilePatterns = *form.BlockedFilePatterns
+	}
+
+	if err := git_model.UpsertOrgPushPolicy(ctx, policy); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, toAPIOrgPushPolicy(policy, orgID))
+}
+
+// DeleteOrgPushPolicy remove the organization's push policy
+func DeleteOrgPushPolicy(ctx *context.APIContext) {
+	if err := git_model.DeleteOrgPushPolicy(ctx, ctx.Org.Organization.ID); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.Status(http.StatusNoContent)
+}

routers/private/hook_pre_receive.go

@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"strconv"
+	"strings"
 
 	asymkey_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/asymkey"
 	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
@@ -160,6 +162,10 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r
 	gitRepo := ctx.Repo.GitRepo
 	objectFormat := ctx.Repo.GetObjectFormat()
 
+	if ctx.checkOrgPushPolicyBranch(oldCommitID, newCommitID, branchName) {
+		return
+	}
+
 	if newCommitID != objectFormat.EmptyObjectID().String() {
 		newCommit, err := gitRepo.GetCommit(newCommitID)
 		if err != nil {
@@ -455,6 +461,10 @@ func preReceiveTag(ctx *preReceiveContext, refFullName git.RefName) {
 
 	tagName := refFullName.TagName()
 
+	if ctx.checkOrgPushPolicyTag(tagName) {
+		return
+	}
+
 	if !ctx.gotProtectedTags {
 		var err error
 		ctx.protectedTags, err = git_model.GetProtectedTags(ctx, ctx.Repo.Repository.ID)
@@ -596,3 +606,102 @@ func (ctx *preReceiveContext) loadPusherAndPermission() bool {
 	ctx.loadedPusher = true
 	return true
 }
+
+// checkOrgPushPolicyBranch enforces the owning organization's push policy on a
+// branch push. It writes a 403 response and returns true when the push is rejected.
+// Content checks (blocked paths, max file size) fail open on unexpected errors so a
+// policy or parsing bug can never block every push in the organization.
+func (ctx *preReceiveContext) checkOrgPushPolicyBranch(oldCommitID, newCommitID, branchName string) bool {
+	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, ctx.Repo.Repository)
+	if err != nil {
+		log.Error("GetOrgPushPolicyForRepo for %-v: %v", ctx.Repo.Repository, err)
+		return false
+	}
+	if policy == nil {
+		return false
+	}
+
+	if !policy.BranchNameAllowed(branchName) {
+		ctx.JSON(http.StatusForbidden, private.Response{
+			UserMsg: fmt.Sprintf("Branch name %q is not allowed by the organization push policy (pattern: %s)", branchName, policy.BranchNamePattern),
+		})
+		return true
+	}
+
+	// Deletions have no content to inspect.
+	if newCommitID == ctx.Repo.GetObjectFormat().EmptyObjectID().String() {
+		return false
+	}
+
+	if globs := policy.BlockedFileGlobs(); len(globs) > 0 {
+		if _, err := pull_service.CheckFileProtection(ctx.Repo.GitRepo, branchName, oldCommitID, newCommitID, globs, 10, ctx.env); err != nil {
+			if pull_service.IsErrFilePathProtected(err) {
+				ctx.JSON(http.StatusForbidden, private.Response{
+					UserMsg: "Push rejected by the organization push policy: a changed file matches a blocked path pattern",
+				})
+				return true
+			}
+			log.Error("org push policy blocked-path check for %-v: %v", ctx.Repo.Repository, err) // fail open
+		}
+	}
+
+	if policy.MaxFileSize > 0 {
+		if path, size := ctx.largestBlobOverLimit(newCommitID, policy.MaxFileSize); path != "" {
+			ctx.JSON(http.StatusForbidden, private.Response{
+				UserMsg: fmt.Sprintf("Push rejected by the organization push policy: %q is %d bytes, over the %d-byte limit", path, size, policy.MaxFileSize),
+			})
+			return true
+		}
+	}
+	return false
+}
+
+// checkOrgPushPolicyTag enforces the organization tag naming policy. Returns true
+// (with a 403 written) when the tag name is rejected.
+func (ctx *preReceiveContext) checkOrgPushPolicyTag(tagName string) bool {
+	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, ctx.Repo.Repository)
+	if err != nil {
+		log.Error("GetOrgPushPolicyForRepo for %-v: %v", ctx.Repo.Repository, err)
+		return false
+	}
+	if policy == nil || policy.TagNameAllowed(tagName) {
+		return false
+	}
+	ctx.JSON(http.StatusForbidden, private.Response{
+		UserMsg: fmt.Sprintf("Tag name %q is not allowed by the organization push policy (pattern: %s)", tagName, policy.TagNamePattern),
+	})
+	return true
+}
+
+// largestBlobOverLimit returns the first file (and its size) in the pushed tip tree
+// that exceeds limit bytes, or ("", 0) if none — or on any error (fail open).
+func (ctx *preReceiveContext) largestBlobOverLimit(commitID string, limit int64) (string, int64) {
+	output, _, err := gitrepo.RunCmdString(ctx,
+		ctx.Repo.Repository,
+		gitcmd.NewCommand("ls-tree", "-r", "--long").
+			AddDynamicArguments(commitID).
+			WithEnv(ctx.env),
+	)
+	if err != nil {
+		log.Error("org push policy ls-tree for %-v: %v", ctx.Repo.Repository, err)
+		return "", 0
+	}
+	for _, line := range strings.Split(output, "\n") {
+		tab := strings.IndexByte(line, '\t')
+		if tab < 0 {
+			continue
+		}
+		fields := strings.Fields(line[:tab]) // mode, type, hash, size
+		if len(fields) < 4 || fields[1] != "blob" {
+			continue
+		}
+		size, perr := strconv.ParseInt(fields[3], 10, 64)
+		if perr != nil {
+			continue
+		}
+		if size > limit {
+			return line[tab+1:], size
+		}
+	}
+	return "", 0
+}

services/security/orchestrator.go

@@ -6,6 +6,7 @@ package security
 import (
 	"context"
 
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
 	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
 	security_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/security"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
@@ -21,7 +22,11 @@ func ScanPushForSecrets(ctx context.Context, repoID int64, commit *git.Commit) [
 		return nil
 	}
 	if !cfg.Enabled || !cfg.BlockOnPush || !cfg.SecretScanner {
-		return nil
+		// The owning organization may mandate secret blocking regardless of the
+		// repository's own scanner config (org push policy).
+		if !orgRequiresSecretBlock(ctx, repoID) {
+			return nil
+		}
 	}
 
 	scanner := NewSecretScanner()
@@ -33,6 +38,22 @@ func ScanPushForSecrets(ctx context.Context, repoID int64, commit *git.Commit) [
 	return findings
 }
 
+// orgRequiresSecretBlock reports whether the repo's owning organization mandates
+// secret blocking on push via its org push policy.
+func orgRequiresSecretBlock(ctx context.Context, repoID int64) bool {
+	repo, err := repo_model.GetRepositoryByID(ctx, repoID)
+	if err != nil {
+		log.Error("orgRequiresSecretBlock: GetRepositoryByID: %v", err)
+		return false
+	}
+	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, repo)
+	if err != nil {
+		log.Error("orgRequiresSecretBlock: GetOrgPushPolicyForRepo: %v", err)
+		return false
+	}
+	return policy != nil && policy.RequireSecretBlock
+}
+
 // ScanOnPush runs enabled scanners against a commit pushed to the default branch.
 // Called from services/repository/push.go on default branch pushes.
 func ScanOnPush(ctx context.Context, repo *repo_model.Repository, commit *git.Commit) {