feat(repo): read-only org push policy and repo defaults views in repo settings (#738)

Surface the owning organization's push policy (GetOrgPushPolicyForRepo) and
repository defaults (GetOrgRepoDefaultsForRepo) as read-only, informational
sections on the repo Branch Protection settings page, mirroring the existing
inherited org branch/tag protection views. Sections only render for org-owned
repos when a policy/defaults row actually exists.

Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT

.mokogitea/workflows/cleanup.yml

@@ -50,7 +50,7 @@ jobs:
           for BRANCH in $BRANCHES; do
             # Skip protected branches
             case "$BRANCH" in
-              main|master|develop|release/*|hotfix/*) continue ;;
+              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
             esac
 
             # Check if branch is merged into main

.mokogitea/workflows/notify.yml

@@ -15,9 +15,9 @@ name: "Universal: Notifications"
 on:
   workflow_run:
     workflows:
-      - "Joomla Build & Release"
+      - "Universal: Build & Release"
-      - "Joomla Extension CI"
+      - "Joomla: Extension CI"
-      - "Deploy"
+      - "Generic: Project CI"
     types:
       - completed
 

options/locale/locale_en-US.json

@@ -2436,6 +2436,31 @@
   "repo.settings.org_protected_tag": "Organization Tag Protection",
   "repo.settings.org_protected_tag_desc": "These tag protection rules are defined by the organization and are enforced on top of this repository's own rules. They cannot be edited here.",
   "repo.settings.org_protected_tag.read_only": "Read-only",
+  "repo.settings.org_push_policy": "Organization Push Policy",
+  "repo.settings.org_push_policy_desc": "This push policy is defined by the organization and enforced on every push to this repository. It cannot be edited here.",
+  "repo.settings.org_push_policy.inherited": "Organization",
+  "repo.settings.org_push_policy.read_only": "Read-only",
+  "repo.settings.org_push_policy.branch_pattern": "Allowed branch names",
+  "repo.settings.org_push_policy.tag_pattern": "Allowed tag names",
+  "repo.settings.org_push_policy.require_secret_block": "Block pushes containing secrets",
+  "repo.settings.org_push_policy.max_file_size": "Maximum file size",
+  "repo.settings.org_push_policy.blocked_files": "Blocked file paths",
+  "repo.settings.org_push_policy.enabled": "Enabled",
+  "repo.settings.org_repo_defaults": "Organization Repository Defaults",
+  "repo.settings.org_repo_defaults_desc": "These defaults are defined by the organization and were applied to this repository when it was created or transferred into the organization. They are shown for reference and cannot be edited here.",
+  "repo.settings.org_repo_defaults.inherited": "Organization",
+  "repo.settings.org_repo_defaults.read_only": "Read-only",
+  "repo.settings.org_repo_defaults.force_private": "Force private repositories",
+  "repo.settings.org_repo_defaults.merge_styles": "Allowed merge styles",
+  "repo.settings.org_repo_defaults.default_merge_style": "Default merge style",
+  "repo.settings.org_repo_defaults.delete_branch_after_merge": "Delete branch after merge",
+  "repo.settings.org_repo_defaults.style_merge": "Merge commits",
+  "repo.settings.org_repo_defaults.style_rebase": "Rebase",
+  "repo.settings.org_repo_defaults.style_rebase_merge": "Rebase with merge commit",
+  "repo.settings.org_repo_defaults.style_squash": "Squash",
+  "repo.settings.org_repo_defaults.style_fast_forward_only": "Fast-forward only",
+  "repo.settings.org_repo_defaults.enabled": "Enabled",
+  "repo.settings.org_repo_defaults.disabled": "Disabled",
   "repo.settings.protected_branch_can_push": "Allow push?",
   "repo.settings.protected_branch_can_push_yes": "You can push",
   "repo.settings.protected_branch_can_push_no": "You cannot push",

routers/web/repo/setting/org_inherited_settings.go

@@ -0,0 +1,51 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package setting
+
+import (
+	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// prepareOrgPushPolicyView surfaces the owning organization's push policy (if any)
+// as a read-only informational section on the repo's branch protection settings page.
+// The policy is enforced org-wide in the pre-receive hook and cannot be edited from
+// the repository. Template data is only populated when the repo is owned by an
+// organization that has a push policy configured (nil policy renders nothing).
+// See issue #738.
+func prepareOrgPushPolicyView(ctx *context.Context) error {
+	if !ctx.Repo.Owner.IsOrganization() {
+		return nil
+	}
+	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, ctx.Repo.Repository)
+	if err != nil {
+		return err
+	}
+	if policy == nil {
+		return nil
+	}
+	ctx.Data["OrgPushPolicy"] = policy
+	return nil
+}
+
+// prepareOrgRepoDefaultsView surfaces the owning organization's repository defaults
+// (if any) as a read-only informational section. These defaults are applied when a
+// repository is created in, or transferred into, the organization; they are shown
+// for reference only and are not editable here. Template data is only populated when
+// the repo is owned by an organization that has repo defaults configured (nil renders
+// nothing). See issue #738.
+func prepareOrgRepoDefaultsView(ctx *context.Context) error {
+	if !ctx.Repo.Owner.IsOrganization() {
+		return nil
+	}
+	defaults, err := git_model.GetOrgRepoDefaultsForRepo(ctx, ctx.Repo.Repository)
+	if err != nil {
+		return err
+	}
+	if defaults == nil {
+		return nil
+	}
+	ctx.Data["OrgRepoDefaults"] = defaults
+	return nil
+}

routers/web/repo/setting/protected_branch.go

@@ -112,6 +112,16 @@ func ProtectedBranchRules(ctx *context.Context) {
 			ctx.ServerError("prepareOrgProtectedBranches", err)
 			return
 		}
+		// Surface the org-wide push policy and the org repo defaults that apply to
+		// this repo (read-only, informational). See issue #738.
+		if err := prepareOrgPushPolicyView(ctx); err != nil {
+			ctx.ServerError("prepareOrgPushPolicyView", err)
+			return
+		}
+		if err := prepareOrgRepoDefaultsView(ctx); err != nil {
+			ctx.ServerError("prepareOrgRepoDefaultsView", err)
+			return
+		}
 	}
 
 	repo.PrepareBranchList(ctx)

templates/repo/settings/branches.tmpl

@@ -144,6 +144,98 @@
 					</div>
 				</div>
 			{{end}}
+
+			{{if .OrgPushPolicy}}
+				<h4 class="ui top attached header">
+					{{ctx.Locale.Tr "repo.settings.org_push_policy"}}
+				</h4>
+				<div class="ui attached segment">
+					<p class="tw-mb-3">
+						{{svg "octicon-organization" 12}} {{ctx.Locale.Tr "repo.settings.org_push_policy.inherited"}}
+						<span class="text grey tw-text-sm tw-ml-2">{{svg "octicon-lock" 12}} {{ctx.Locale.Tr "repo.settings.org_push_policy.read_only"}}</span>
+					</p>
+					<p class="tw-mb-3">{{ctx.Locale.Tr "repo.settings.org_push_policy_desc"}}</p>
+					<table class="ui very basic compact table tw-w-auto">
+						<tbody>
+							{{if .OrgPushPolicy.BranchNamePattern}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.branch_pattern"}}</td>
+									<td><code>{{.OrgPushPolicy.BranchNamePattern}}</code></td>
+								</tr>
+							{{end}}
+							{{if .OrgPushPolicy.TagNamePattern}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.tag_pattern"}}</td>
+									<td><code>{{.OrgPushPolicy.TagNamePattern}}</code></td>
+								</tr>
+							{{end}}
+							{{if .OrgPushPolicy.RequireSecretBlock}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.require_secret_block"}}</td>
+									<td>{{svg "octicon-check" 14}} {{ctx.Locale.Tr "repo.settings.org_push_policy.enabled"}}</td>
+								</tr>
+							{{end}}
+							{{if gt .OrgPushPolicy.MaxFileSize 0}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.max_file_size"}}</td>
+									<td>{{FileSize .OrgPushPolicy.MaxFileSize}}</td>
+								</tr>
+							{{end}}
+							{{if .OrgPushPolicy.BlockedFilePatterns}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.blocked_files"}}</td>
+									<td><code>{{.OrgPushPolicy.BlockedFilePatterns}}</code></td>
+								</tr>
+							{{end}}
+						</tbody>
+					</table>
+				</div>
+			{{end}}
+
+			{{if .OrgRepoDefaults}}
+				<h4 class="ui top attached header">
+					{{ctx.Locale.Tr "repo.settings.org_repo_defaults"}}
+				</h4>
+				<div class="ui attached segment">
+					<p class="tw-mb-3">
+						{{svg "octicon-organization" 12}} {{ctx.Locale.Tr "repo.settings.org_repo_defaults.inherited"}}
+						<span class="text grey tw-text-sm tw-ml-2">{{svg "octicon-lock" 12}} {{ctx.Locale.Tr "repo.settings.org_repo_defaults.read_only"}}</span>
+					</p>
+					<p class="tw-mb-3">{{ctx.Locale.Tr "repo.settings.org_repo_defaults_desc"}}</p>
+					<table class="ui very basic compact table tw-w-auto">
+						<tbody>
+							<tr>
+								<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.force_private"}}</td>
+								<td>{{if .OrgRepoDefaults.ForcePrivate}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.enabled"}}{{else}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.disabled"}}{{end}}</td>
+							</tr>
+							{{if .OrgRepoDefaults.ApplyPRDefaults}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.merge_styles"}}</td>
+									<td>
+										<div class="tw-flex tw-gap-1 tw-flex-wrap">
+											{{if .OrgRepoDefaults.AllowMerge}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_merge"}}</span>{{end}}
+											{{if .OrgRepoDefaults.AllowRebase}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_rebase"}}</span>{{end}}
+											{{if .OrgRepoDefaults.AllowRebaseMerge}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_rebase_merge"}}</span>{{end}}
+											{{if .OrgRepoDefaults.AllowSquash}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_squash"}}</span>{{end}}
+											{{if .OrgRepoDefaults.AllowFastForwardOnly}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_fast_forward_only"}}</span>{{end}}
+										</div>
+									</td>
+								</tr>
+								{{if .OrgRepoDefaults.DefaultMergeStyle}}
+									<tr>
+										<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.default_merge_style"}}</td>
+										<td><code>{{.OrgRepoDefaults.DefaultMergeStyle}}</code></td>
+									</tr>
+								{{end}}
+								<tr>
+									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.delete_branch_after_merge"}}</td>
+									<td>{{if .OrgRepoDefaults.DeleteBranchAfterMerge}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.enabled"}}{{else}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.disabled"}}{{end}}</td>
+								</tr>
+							{{end}}
+						</tbody>
+					</table>
+				</div>
+			{{end}}
 		{{end}}
 	</div>