MokoConsulting/MokoGitea-Fork
1
0
Fork 0
Code Issues 123 Pull Requests Releases 96 Wiki Activity

release: branch protection delete allowlist (#696) #707

Merged
jmiller merged 7 commits from dev into main 2026-06-28 01:20:32 +00:00
Conversation 0 Commits 7 Files Changed 14
+345 -29
jmiller commented 2026-06-28 01:18:07 +00:00
Owner
Copy Link
Copy Source

Summary

  • Branch protection delete allowlist: configurable per-user/team/deploy-key allowlist for deleting protected branches (#696)
  • Migration v361 adds 6 new columns to protected_branch table
  • Full stack: model, pre-receive hook, branch service, API (create+edit), web UI, locale strings
  • Default permission: admin access (higher threshold than force-push's write access)

Changes (13 files, +345/-20)

  • models/git/protected_branch.go — 6 fields, CanUserDelete() method, whitelist options, removal helpers
  • models/migrations/v1_27/v361.go — migration v361
  • modules/structs/repo_branch.go — API struct fields (BranchProtection, Create, Edit)
  • routers/private/hook_pre_receive.go — delete check with early user resolution
  • services/repository/branch.go — CanDeleteBranch uses allowlist-aware check
  • routers/api/v1/repo/branch.go — create/edit branch protection endpoints
  • routers/web/repo/setting/protected_branch.go — web form handler
  • templates/repo/settings/protected_branch.tmpl — UI section (none/all/allowlist radio)
  • services/convert/convert.go — model-to-API mapping
  • services/forms/repo_form.go — form struct fields
  • options/locale/locale_en-US.json — 12 locale strings

Test plan

  • Create branch protection with delete disabled (default) — verify branch cannot be deleted
  • Enable delete for "all" — verify admins can delete
  • Enable delete with allowlist — verify only allowlisted users/teams can delete
  • API: create/edit branch protection with delete allowlist fields
  • Web UI: settings page shows delete section with correct radio/dropdown behavior
  • Non-allowlisted users get 403 on delete via git push

https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd

## Summary - Branch protection delete allowlist: configurable per-user/team/deploy-key allowlist for deleting protected branches (#696) - Migration v361 adds 6 new columns to protected_branch table - Full stack: model, pre-receive hook, branch service, API (create+edit), web UI, locale strings - Default permission: admin access (higher threshold than force-push's write access) ## Changes (13 files, +345/-20) - `models/git/protected_branch.go` — 6 fields, `CanUserDelete()` method, whitelist options, removal helpers - `models/migrations/v1_27/v361.go` — migration v361 - `modules/structs/repo_branch.go` — API struct fields (BranchProtection, Create, Edit) - `routers/private/hook_pre_receive.go` — delete check with early user resolution - `services/repository/branch.go` — `CanDeleteBranch` uses allowlist-aware check - `routers/api/v1/repo/branch.go` — create/edit branch protection endpoints - `routers/web/repo/setting/protected_branch.go` — web form handler - `templates/repo/settings/protected_branch.tmpl` — UI section (none/all/allowlist radio) - `services/convert/convert.go` — model-to-API mapping - `services/forms/repo_form.go` — form struct fields - `options/locale/locale_en-US.json` — 12 locale strings ## Test plan - [ ] Create branch protection with delete disabled (default) — verify branch cannot be deleted - [ ] Enable delete for "all" — verify admins can delete - [ ] Enable delete with allowlist — verify only allowlisted users/teams can delete - [ ] API: create/edit branch protection with delete allowlist fields - [ ] Web UI: settings page shows delete section with correct radio/dropdown behavior - [ ] Non-allowlisted users get 403 on delete via git push https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd
jmiller added 7 commits 2026-06-28 01:18:08 +00:00
Merge pull request 'merge: sync main into dev' (#705) from main into dev
Universal: Auto Version Bump / Version Bump (push) Has been skipped
Details
Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || github.ref_name }}) (push) Failing after 51s
Details
Deploy MokoGitea (Dev) / Build & Deploy to Dev (push) Failing after 1m12s
Details
46cbf6600a
feat: add delete allowlist for branch protection rules (#696)
Universal: Auto Version Bump / Version Bump (push) Successful in 12s
Details
PR RC Release / Build RC Release (pull_request) Successful in 2s
Details
Universal: PR Check / Branch Policy (pull_request) Successful in 1s
Details
Universal: PR Check / Validate PR (pull_request) Failing after 13s
Details
Universal: PR Check / Secret Scan (pull_request) Successful in 1m33s
Details
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Details
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Details
4178e7f23e 
Add configurable per-user/team/deploy-key allowlist for deleting
protected branches. Previously, protected branches could never be
deleted via git push. Now admins can configure deletion permissions
with the same granularity as force-push allowlists.

- 6 new model fields: CanDelete, EnableDeleteAllowlist, DeleteAllowlistUserIDs/TeamIDs, DeleteAllowlistDeployKeys, DeleteAllowlistActionsUser
- CanUserDelete() method with admin-level default (higher than push)
- Migration v361 adds columns to protected_branch table
- Pre-receive hook checks delete allowlist instead of unconditional block
- CanDeleteBranch service uses CanUserDelete instead of IsBranchProtected
- API create/edit endpoints support delete allowlist fields
- Web UI settings page with radio buttons and user/team dropdowns
- 12 new locale strings for the delete allowlist UI

Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd
fix: restore original whitespace alignment in convert.go
PR RC Release / Build RC Release (pull_request) Successful in 3s
Details
Universal: PR Check / Branch Policy (pull_request) Successful in 3s
Details
Universal: PR Check / Validate PR (pull_request) Failing after 9s
Details
Universal: Auto Version Bump / Version Bump (push) Successful in 17s
Details
Universal: PR Check / Secret Scan (pull_request) Successful in 1m7s
Details
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Details
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Details
c47013edb0 
Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd
fix: set protectBranch.Repo before CanUserDelete to avoid extra DB load
PR RC Release / Build RC Release (pull_request) Successful in 2s
Details
Universal: PR Check / Branch Policy (pull_request) Successful in 2s
Details
Universal: PR Check / Validate PR (pull_request) Failing after 9s
Details
Universal: Auto Version Bump / Version Bump (push) Successful in 12s
Details
Universal: PR Check / Secret Scan (pull_request) Successful in 1m8s
Details
RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped
Details
Branch Cleanup / Delete merged branch (pull_request) Successful in 2s
Details
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Details
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Details
81d20e25bf 
Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd
Merge pull request 'feat: add delete allowlist for branch protection rules (#696)' (#706) from feature/delete-whitelist into dev
Universal: Auto Version Bump / Version Bump (push) Has been skipped
Details
Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || github.ref_name }}) (push) Failing after 1m20s
Details
Deploy MokoGitea (Dev) / Build & Deploy to Dev (push) Failing after 1m26s
Details
92cf6a8521
merge: incorporate workflow sync from main into dev 3cb45ba457
fix: remove duplicate cascade-dev.yml synced to top-level (belongs in custom/)
Generic: Repo Health / Access control (pull_request) Successful in 1s
Details
Generic: Repo Health / Site Health (pull_request) Has been skipped
Details
Deploy MokoGitea (Dev) / Build & Deploy to Dev (push) Failing after 1m21s
Details
Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || github.ref_name }}) (push) Failing after 1m12s
Details
Branch Cleanup / Delete merged branch (pull_request) Has been skipped
Details
RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped
Details
Universal: Build & Release / Promote to RC (pull_request) Has been skipped
Details
Universal: Build & Release / Build & Release Pipeline (pull_request) Failing after 59s
Details
Universal: Workflow Sync Trigger / Sync workflows to live repos (pull_request) Failing after 4m11s
Details
Generic: Repo Health / Scripts governance (pull_request) Has been cancelled
Details
Generic: Repo Health / Repository health (pull_request) Has been cancelled
Details
Generic: Repo Health / Report: Scripts Governance (pull_request) Has been cancelled
Details
Generic: Repo Health / Report: Repository Health (pull_request) Has been cancelled
Details
Universal: Auto Version Bump / Version Bump (push) Successful in 13s
Details
Universal: PR Check / Branch Policy (pull_request) Successful in 1s
Details
PR RC Release / Build RC Release (pull_request) Successful in 2s
Details
Universal: PR Check / Validate PR (pull_request) Failing after 9s
Details
Generic: Project CI / Lint & Validate (pull_request) Successful in 33s
Details
Universal: PR Check / Secret Scan (pull_request) Successful in 1m21s
Details
Generic: Project CI / Tests (pull_request) Has been cancelled
Details
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Details
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Details
d2a3827202 
Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd
jmiller merged commit 8ffd2ffe18 into main 2026-06-28 01:20:32 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
breaking-change
Breaking API or behavior change
 ci-cd
CI/CD pipeline changes
 config
Configuration changes
 dependencies
Dependency updates
 deploy-failure
Deployment failed
 docker
Docker/container changes
 documentation
Documentation changes
 feature: wiki
Wiki system enhancements
 good first issue
Good for newcomers
 health-check
Repo health check result
 help wanted
Extra attention needed
 mokostandards
Related to MokoStandards framework
 push-failure
Git push operation failed
 security
Security vulnerability or hardening
 size/l
200-500 lines changed
 size/m
50-200 lines changed
 size/s
10-50 lines changed
 size/xl
500+ lines changed
 size/xs
< 10 lines changed
 standards-drift
Deviates from MokoStandards
 standards-update
MokoStandards compliance update
 sync-failure
Sync or mirror failed
 tech-debt
Technical debt and TODO/FIXME items
 upstream
upstream
Inherited from upstream Gitea
 work-in-progress
Draft or incomplete work
No labels
Priority -
Type -
Milestone
No items
No Milestone
Assignees
Clear assignees
jmiller (Jonathan Miller) moko-deploy (Moko Deploy Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-Fork#707
Delete Branch "dev"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?