一种限制 Git 分支访问的方法？

A way to restrict Git branch access?

提问by David542

I have four branches in my git repository, which is managed using GitHub:

我的 git 存储库中有四个分支，使用 GitHub 进行管理：

• Production
• Staging
• Master
• [person's name]-development

• 生产
• 分期
• 掌握
• [人名]-发展

Is there a way to restrict write access to only a single branch ([person's name]-development)? How would I do this?

有没有办法限制对单个分支的写访问（[人名]-development）？我该怎么做？

For reference, a similar question: How to write a git hook to restrict writing to branch?.

作为参考，一个类似的问题：如何编写 git hook 来限制写入分支？.

采纳答案by Esko Luontola

When using GitHub, your best option would be for each developer to have their own fork of the master repository. Everybody pushes to their own repository and somebody with push access to the master repository handles pulling from each developer's repository. This is how most open source projects work.

使用 GitHub 时，最好的选择是让每个开发人员拥有自己的主存储库的分支。每个人都推送到他们自己的存储库，并且对主存储库具有推送访问权限的人处理从每个开发人员的存储库中提取的内容。这就是大多数开源项目的工作方式。

If using your own Git server, it should be possible to use hooks to prevent users from pushing to wrong branches.

如果使用自己的 Git 服务器，应该可以使用钩子来防止用户推送到错误的分支。

回答by osowskit

GitHub added the functionality to restrict which users can push to a branchfor Organizations earlier this year.

GitHub 在今年早些时候添加了限制哪些用户可以推送到Organizations分支的功能。

回答by VonC

Note: Protected branches and required status checks(September 3, 2015) won't exactlyallow a single branch ("[person's name]-development"), but it getting clone.

注意：受保护的分支和必需的状态检查（2015 年 9 月 3 日）不会完全允许单个分支（“[person's name]-development”），但它会得到克隆。

The branch will be protected:

分支将受到保护：

• against forced pushed
• against deletion
• against merged changes until required status checks pass

• 反对强推
• 反对删除
• 反对合并的更改，直到所需的状态检查通过

回答by cdmo

You might want to check out GitLab and its "protected branch" feature. I think it's pretty much exactly what you are looking for. See Keeping your code protected.

您可能想查看 GitLab 及其“受保护分支”功能。我认为这几乎正是你正在寻找的。请参阅保护您的代码。

回答by Evgeny Lukianchikov

Eskosuggested great solution suitable for open-source projects. However it requires that every member of a collaborators team has a paid account on GitHub, which is not always true.

Esko提出了适用于开源项目的出色解决方案。然而，它要求协作团队的每个成员在 GitHub 上都有一个付费帐户，这并不总是正确的。

VonCpointed out that there's another solution which involves only one paid GitHub account. And I'm going to provide some tutorial how to implement VonC's solution.

VonC指出，还有另一种解决方案，只涉及一个付费 GitHub 帐户。我将提供一些如何实施 VonC 解决方案的教程。

Let's suppose that we have two private repositories: test-testand test-production. The first repo is for development and every member of a team has access to it. The second repo is for automatic deployment of code and therefore strong access restrictions are applied to it.

假设我们有两个私有存储库：test-test和test-production. 第一个 repo 用于开发，团队的每个成员都可以访问它。第二个 repo 用于代码的自动部署，因此对其应用了强访问限制。

Setup for developers is pretty simple and staightforward: git clone https://github.com/<username>/test-test, do their work and push it back.

开发人员的设置非常简单和直接： git clone https://github.com/<username>/test-test完成他们的工作并将其推回。

Setup for collaborators is a bit more complicated:

协作者的设置有点复杂：

1. Pull branches from the development repo git clone https://github.com/<username>/test-test

2. Add remote repository git remote add production-repo https://github.com/<username>/test-production.git

3. Fetch data from new repo git fetch production-repo

4. Create new local branch for production code and switch to it git checkout -b local-production

5. Tell git to link local and remote branches git branch -u production-repo/production

6. Download contents of the remote production branch to the local one git pull

7. Sort out possible conflicts and that's it!

1. 从开发库中拉取分支 git clone https://github.com/<username>/test-test

2. 添加远程仓库 git remote add production-repo https://github.com/<username>/test-production.git

3. 从新仓库中获取数据 git fetch production-repo

4. 为生产代码创建新的本地分支并切换到它 git checkout -b local-production

5. 告诉 git 链接本地和远程分支 git branch -u production-repo/production

6. 将远程生产分支的内容下载到本地 git pull

7. 整理出可能的冲突，就是这样！

Now everything that is pushed from the local-productionbranch will get into the test-productionrepo and the other branches will be pushed to the test-testrepo.

现在从local-production分支推送的所有内容都将进入test-productionrepo，其他分支将被推送到test-testrepo。

Ok, that's cool, but what about more granular ([person's name]-development) access?- You may ask. The answer is: you can create repos similar to test-testfor every developer and use the same pattern for setting them up. The downside of this approach is that collaborators will have to clone each of test-test-[person's name]-developmentrepos.

好的，这很酷，但是更精细的（[人名]-开发）访问呢？- 你可能会问。答案是：您可以test-test为每个开发人员创建类似的存储库，并使用相同的模式来设置它们。这种方法的缺点是合作者必须克隆每个存储test-test-[person's name]-development库。

VonC also suggested to fork the productionrepo and to make pull requests to it - why not to do like that?Firstly, because you can't fork a private repo without having paid GitHub account. Secondly, to allow someone to fork a privaterepo, you give him full access to it, so he can push to it directly. And a developer can make a mistake, push to the productionrepo launching GitHub service hooks and screwing things up. And if you use several outsource developers, this will likely happen.

VonC 还建议对productionrepo进行分叉并向其发出拉取请求 - 为什么不这样做呢？首先，因为你不能在没有支付 GitHub 账户的情况下分叉私有仓库。其次，要允许某人分叉私人回购，您可以让他完全访问它，这样他就可以直接推送到它。开发人员可能会犯错误，推送到productionrepo 启动 GitHub 服务挂钩并搞砸。如果您使用多个外包开发人员，这很可能会发生。

Also I'd like to warn you about a bugfeature in the official GitHub app for Windows. The branches with an upstream different from the origin will get into origin. So use the command line for pushing.

另外，我想警告您有关Windows 官方 GitHub 应用程序中的错误功能。上游与原点不同的分支将进入原点。所以使用命令行进行推送。

All these things sound little bit overcomplicated. But it is always like that if you don't want to pay for simplicity.

所有这些事情听起来有点过于复杂。但是，如果您不想为简单而付费，则总是如此。

回答by Oli

As with GitLab, so does BitBucket.org have a branch restriction feature.

与 GitLab 一样，BitBucket.org 也有分支限制功能。

http://blog.bitbucket.org/2013/09/16/take-control-with-branch-restrictions/

http://blog.bitbucket.org/2013/09/16/take-control-with-branch-restrictions/

回答by Joey Trang

In Bitbucket version (Bitbucket v4.9.1) You can restrict changes by:

在 Bitbucket 版本（Bitbucket v4.9.1）中，您可以通过以下方式限制更改：

1. Branch name
2. Branch name pattern
3. Branch name modelling

1. 分店名称
2. 分支名称模式
3. 分支名称建模

Following actions can by restricted:

可以限制以下操作：

1. Prevent all changes
2. Prevent deletion
3. Prevent rewirting history
4. Prevent changes without a pull request

1. 阻止所有更改
2. 防止删除
3. 防止重写历史记录
4. 在没有拉取请求的情况下防止更改

Enter user that is an exception;

输入例外的用户；

回答by Tobias Gaertner

If you use bitbucket - there are branch-permissions for handling that. https://confluence.atlassian.com/bitbucket/branch-permissions-385912271.html

如果您使用 bitbucket - 有处理它的分支权限。 https://confluence.atlassian.com/bitbucket/branch-permissions-385912271.html

回答by duskwuff -inactive-

Not practically. Git branches aren't really distinct from one another in the way that you're probably thinking they are.

实际上不是。Git 分支并没有像您可能认为的那样彼此区别开来。

What you probably want to do here is use a separate repository for each user's development branch.

您可能想要在这里做的是为每个用户的开发分支使用单独的存储库。