5

How can we implement server-side hooks, or any similar solution, to restrict git push into git server?

For example, we want to disable push of commits containing *.class files.

Daniel Mann
  • 57,011
  • 13
  • 100
  • 120
Yael
  • 61
  • 1
  • 1
  • 3
  • 1
    Service hook can't help you, because the hook started only AFTER the code is pushed, you can't catch the moment before. the best thing it to use `.gitignore` file. – Shayki Abramczyk Jan 16 '19 at 08:52

4 Answers4

5

I don't think Azure DevOps uses hooks.

You can use Branch Policies to make use of an external validation service (as I understand it this uses web hooks).

Additional: the status of this User Voice request indicates the above is the official answer.

But maybe the simple case would be .gitignore and code reviews?

Richard
  • 106,783
  • 21
  • 203
  • 265
  • Azure DevOps does have services hooks - https://learn.microsoft.com/en-us/azure/devops/service-hooks/services/webhooks?view=vsts Branch Policies it only to merge between branches, not for each push. – Shayki Abramczyk Jan 16 '19 at 08:53
  • As I understand, branch policies enables applying restrictions to disable direct push without pull requests. But I can't find a way to inspect commits metadata and content. – Yael Jan 16 '19 at 09:09
  • 1
    About service hooks - I understand I can subscribe to push events, but only for notification purpose. Is the push event cancelable? – Yael Jan 16 '19 at 09:11
  • @Yael Azure DevOps has web hook support for various things, these are push only. Branch policies also allow external validation service which does allow a response. – Richard Jan 16 '19 at 10:13
  • Hi @Richard, sorry, I really need more guidance. Can you explain how I can use branch policies to restrict push of commits according to their content? Thanks! – Yael Jan 16 '19 at 14:12
  • @Yael You will need to implement a service to host the logic. This will mean deployment to a point reachable from Azure DevOps. There is nothing inbuilt. – Richard Jan 16 '19 at 14:42
  • 3
    For anyone also searching for the feedback since Uservoice has been closed: https://developercommunity.visualstudio.com/idea/365841/add-git-pre-receive-hooks.html Please vote on this to make MS aware at least... – Thomas Sep 10 '20 at 10:21
  • The branch policies offer really only the policy part. The policy is based on a status pushed by the external service to the PR, using Status API. The external service may be called using a service hook, or it might be called from a pipeline that is configured to run as part of the PR validation, i.e. as yet another branch policy. The latter may enable more granular application of the policy without assistance of the external service itself. https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops#require-approval-from-external-services – Palec Mar 31 '21 at 22:09
3

What I do is using build option together with policies in Azure DevOps. This is my azure-pipelines.yml file:

---
trigger:
  branches:
    exclude:
      - '*'

pool:
  vmImage: 'ubuntu-latest'

steps:
  - script: sudo apt-get install python3-pip
    displayName: 'Install Python PIP'

  - script: sudo apt-get install python3-setuptools
    condition: succeeded()
    displayName: Install Python SetupTools

  - script: sudo pip3 install -r requirements.txt
    condition: succeeded()
    displayName: Install Python PIP Packages

  - task: PythonScript@0
    inputs:
      scriptSource: filePath
      scriptPath: hooks/lint_checker.py
      pythonInterpreter: python3
    condition: succeeded()
    displayName: Lint Checker
imjoseangel
  • 3,543
  • 3
  • 22
  • 30
2

Use branch policies and set merge only with PR, after that direct push to the branch will be disabled, you can skip these policies for certain users (build users or admins) enter image description here

Pankaj Upadhyay
  • 419
  • 3
  • 6
0

This can be achieved with a branch policy with a path filter on it. You could add a build pipeline with some powershell that returns a failed exit code.

enter image description here

Jack
  • 15,614
  • 19
  • 67
  • 92