feat: Repository & Org-level ruleset system (branch protection) #38

New Issue

2026-05-08T04:46:04Z

jmiller commented

2026-05-08 04:46:04 +00:00

Advanced protection rules for repository and organization management:

Org-level branch protection rulesets that cascade to all repos (Phase 1-3 complete)
Pattern-based rulesets across branches (main, dev, rc/*, beta/*, alpha/*)
Required status checks with bypass options
Required reviews with code owners integration
Signed commit requirements
File path restrictions
Full CRUD API at both repo and org level
Inheritance: repo rules override org rules

Branch: dev/org-branch-protection
Version: 1261.0.0

See comment below for full implementation plan.

Advanced protection rules for repository and organization management: - **Org-level branch protection rulesets** that cascade to all repos (Phase 1-3 complete) - Pattern-based rulesets across branches (`main`, `dev`, `rc/*`, `beta/*`, `alpha/*`) - Required status checks with bypass options - Required reviews with code owners integration - Signed commit requirements - File path restrictions - Full CRUD API at both repo and org level - Inheritance: repo rules override org rules **Branch:** `dev/org-branch-protection` **Version:** 1261.0.0 See comment below for full implementation plan.

jmiller added the type: feature label 2026-05-11 17:08:56 +00:00

jmiller commented

2026-05-12 20:16:54 +00:00

Full Implementation Plan: Org-Level Branch Protection Rulesets

Status: Phase 1-3 Complete (branch `dev/org-branch-protection`)

Problem

MokoGitea fork has 50+ repos all needing identical branch protection rules (main, dev, rc/*, beta/*, alpha/*). Currently managed per-repo with bulk scripts. Need GitHub-style org-level rulesets that cascade to all repos automatically.

Implementation Summary

Phase 1: Data Model + Migration ✅

New table: org_protected_branch (migration v332)
Mirrors protected_branch fields but scoped to org_id instead of repo_id
Uses team-based whitelists only (no per-user IDs at org level)
Unique constraint: (org_id, rule_name)

Phase 2: API Endpoints ✅

GET    /api/v1/orgs/{org}/branch_protections
POST   /api/v1/orgs/{org}/branch_protections
GET    /api/v1/orgs/{org}/branch_protections/{name}
PATCH  /api/v1/orgs/{org}/branch_protections/{name}
DELETE /api/v1/orgs/{org}/branch_protections/{name}

Auth: reqToken() + reqOrgOwnership()

Phase 3: Inheritance Logic ✅

Modified GetFirstMatchProtectedBranchRule() to fall back to org rules
Repo-level rules take full precedence (no field-by-field merge)
Added inherited_from field to BranchProtection API response

Phase 4: UI (Future)

Org Settings > Branch Protection tab
Repo-level UI shows inherited rules as read-only with "Inherited from org" badge

Files Created

File	Purpose
`models/git/org_protected_branch.go`	OrgProtectedBranch model + CRUD + glob matching
`models/migrations/v1_27/v332.go`	Migration to create `org_protected_branch` table
`modules/structs/org_branch.go`	API request/response types
`routers/api/v1/org/branch_protection.go`	Full CRUD API handlers

Files Modified

File	Change
`models/git/protected_branch_list.go`	Org rule fallback in `GetFirstMatchProtectedBranchRule()`
`models/migrations/migrations.go`	Register migration 332
`modules/structs/repo_branch.go`	Added `InheritedFrom` field
`routers/api/v1/api.go`	Route registration

Additional Changes in Same Branch

Configurable Help/Support URLs: HELP_URL and SUPPORT_URL in app.ini, replacing hardcoded docs.gitea.com in navbar
Admin visibility: Help/Support URLs shown in Site Admin > Configuration
Version convention: 1261.xx.xx (1261 = fork starting point from upstream Gitea)

Verification Checklist

Create org rule via API, verify it applies to repos without their own rule
Verify repo-level rule overrides org rule for same branch pattern
Verify rule deletion at org level removes protection from all repos
Run existing branch protection tests to ensure no regressions
Test glob patterns: rc/*, beta/*, alpha/*

Documentation / Communication

Update MokoGitea wiki with org branch protection API docs
Update mokoconsulting.tech website articles with feature announcement
Add admin guide for configuring HELP_URL and SUPPORT_URL
Document version numbering convention (1261.xx.xx)

Authored by Claude Opus 4.6 — Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

## Full Implementation Plan: Org-Level Branch Protection Rulesets ### Status: Phase 1-3 Complete (branch `dev/org-branch-protection`) --- ### Problem MokoGitea fork has 50+ repos all needing identical branch protection rules (`main`, `dev`, `rc/*`, `beta/*`, `alpha/*`). Currently managed per-repo with bulk scripts. Need GitHub-style org-level rulesets that cascade to all repos automatically. --- ### Implementation Summary #### Phase 1: Data Model + Migration ✅ - **New table:** `org_protected_branch` (migration v332) - Mirrors `protected_branch` fields but scoped to `org_id` instead of `repo_id` - Uses team-based whitelists only (no per-user IDs at org level) - Unique constraint: `(org_id, rule_name)` #### Phase 2: API Endpoints ✅ ``` GET /api/v1/orgs/{org}/branch_protections POST /api/v1/orgs/{org}/branch_protections GET /api/v1/orgs/{org}/branch_protections/{name} PATCH /api/v1/orgs/{org}/branch_protections/{name} DELETE /api/v1/orgs/{org}/branch_protections/{name} ``` Auth: `reqToken()` + `reqOrgOwnership()` #### Phase 3: Inheritance Logic ✅ - Modified `GetFirstMatchProtectedBranchRule()` to fall back to org rules - Repo-level rules take full precedence (no field-by-field merge) - Added `inherited_from` field to `BranchProtection` API response #### Phase 4: UI (Future) - [ ] Org Settings > Branch Protection tab - [ ] Repo-level UI shows inherited rules as read-only with "Inherited from org" badge --- ### Files Created | File | Purpose | |------|--------| | `models/git/org_protected_branch.go` | OrgProtectedBranch model + CRUD + glob matching | | `models/migrations/v1_27/v332.go` | Migration to create `org_protected_branch` table | | `modules/structs/org_branch.go` | API request/response types | | `routers/api/v1/org/branch_protection.go` | Full CRUD API handlers | ### Files Modified | File | Change | |------|--------| | `models/git/protected_branch_list.go` | Org rule fallback in `GetFirstMatchProtectedBranchRule()` | | `models/migrations/migrations.go` | Register migration 332 | | `modules/structs/repo_branch.go` | Added `InheritedFrom` field | | `routers/api/v1/api.go` | Route registration | --- ### Additional Changes in Same Branch - **Configurable Help/Support URLs:** `HELP_URL` and `SUPPORT_URL` in `app.ini`, replacing hardcoded `docs.gitea.com` in navbar - **Admin visibility:** Help/Support URLs shown in Site Admin > Configuration - **Version convention:** `1261.xx.xx` (1261 = fork starting point from upstream Gitea) --- ### Verification Checklist - [ ] Create org rule via API, verify it applies to repos without their own rule - [ ] Verify repo-level rule overrides org rule for same branch pattern - [ ] Verify rule deletion at org level removes protection from all repos - [ ] Run existing branch protection tests to ensure no regressions - [ ] Test glob patterns: `rc/*`, `beta/*`, `alpha/*` ### Documentation / Communication - [ ] Update MokoGitea wiki with org branch protection API docs - [ ] Update mokoconsulting.tech website articles with feature announcement - [ ] Add admin guide for configuring HELP_URL and SUPPORT_URL - [ ] Document version numbering convention (1261.xx.xx) --- *Authored by Claude Opus 4.6 — Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>*

jmiller changed title from ~~feat: Repository ruleset system~~ to feat: Repository & Org-level ruleset system (branch protection)

2026-05-12 20:17:04 +00:00

jmiller referenced a pull request that will close this issue

2026-05-12 20:20:21 +00:00

feat(org): add org-level branch protection rulesets & configurable help URLs #71

jmiller referenced a pull request that will close this issue

2026-05-12 20:22:56 +00:00

feat(org): add org-level branch protection rulesets & configurable help URLs #72

jmiller closed this issue

2026-05-12 20:24:15 +00:00

jmiller referenced this issue

2026-05-12 20:25:02 +00:00