Enable branch protection rules in Github at the Organisation level

Question

Is it possible to enable branch protection rules at the organisation level in Github so that all repositories part of that organisation inherit these rules for the applied branches. Right now its really a hassle to enable those same set of rules on a per repo basis for same set of branches.

score 8 · Accepted Answer · answered Jan 22 '19 at 20:31

I got it to work using a simple ruby script that makes use of the GitHub APIs :-

require "json"
require "logger"

LOGGER = Logger.new(STDOUT)

def run(cmd)
  LOGGER.debug("Running: #{cmd}")
  output = `#{cmd}`
  raise "Error: #{$?}" unless $?.success?
  output
end


def repos(page = 1, list = [])
  cmd = %Q{curl -s --user "user:pwd" https://github_url/api/v3/orgs/org_name/repos?page=#{page}}
  data = JSON.parse(run(cmd))
  list.concat(data)
  repos(page + 1, list) unless data.empty?
  list
end

repos.each do |repo|
  require 'net/http'
require 'uri'
require 'json'

uri = URI.parse("https://github_url/api/v3/repos/org_name/#{repo["name"]}/branches/master/protection")
request = Net::HTTP::Put.new(uri)
request.basic_auth("user", "pwd")
request["Accept"] = "application/vnd.github.luke-cage-preview+jso"
request.body = JSON.dump({
  "required_status_checks" => {
    "strict" => true,
    "contexts" => [
      "continuous-integration/travis-ci"
    ]
  },
  "enforce_admins" => true,
  "required_pull_request_reviews" => {
    "dismiss_stale_reviews" => true
  },
  "restrictions" => nil
})

req_options = {
  use_ssl: uri.scheme == "https",
}

response = Net::HTTP.start(uri.hostname, uri.port, req_options) do |http|
  http.request(request)
end
end

I took this code as a base, made a few adjustments and now it works great, thanks Ashley — gvasquez, Apr 17 '20 at 13:37

score 4 · Answer 2 · answered Apr 17 '20 at 13:50

Taken from @Ashley 's answers, updated it a bit, with a slight change to reflect current Github's API URLs and, added customization using GITHUB_ORG and GITHUB_ACCESS_TOKEN environment variables.

require "json"
require "logger"

$org = ENV["GITHUB_ORG"]
$token = ENV["GITHUB_ACCESS_TOKEN"]

LOGGER = Logger.new(STDOUT)

def run(cmd)
  LOGGER.debug("Running: #{cmd}")
  output = `#{cmd}`
  raise "Error: #{$?}" unless $?.success?
  output
end


def repos(page = 1, list = [])
  cmd = %Q{curl -s -u dummy:#{$token} https://api.github.com/orgs/#{$org}/repos?page=#{page}}
  data = JSON.parse(run(cmd))
  list.concat(data)
  repos(page + 1, list) unless data.empty?
  list
end

repos.each do |repo|
p(repo["name"])
  require 'net/http'
require 'uri'
require 'json'

uri = URI.parse("https://api.github.com/repos/#{$org}/#{repo["name"]}/branches/master/protection")
request = Net::HTTP::Put.new(uri)
request.basic_auth("dummy", $token)
request["Accept"] = "application/vnd.github.luke-cage-preview+jso"
request.body = JSON.dump({
  "required_status_checks" => {
    "strict" => true,
    "contexts" => []
  },
  "enforce_admins" => true,
  "required_pull_request_reviews" => {
    "dismiss_stale_reviews" => true
  },
  "restrictions" => nil
})

req_options = {
  use_ssl: uri.scheme == "https",
}

response = Net::HTTP.start(uri.hostname, uri.port, req_options) do |http|
  http.request(request)
end
p(response)
end

score 1 · Answer 3 · answered Jan 17 '19 at 01:10

1

You should try using the Github API's update branch protection endpoint with some kind of automated process to apply branch protection rules to all new branches in your organization.

PUT /repos/:owner/:repo/branches/:branch/protection

answered Jan 17 '19 at 01:10

Adil B

14,635
11
60
78

Thanks for the response. I could use API to successfully enable branch protection one of the branches in one of the repos but how to achieve that for all repos and a set of branches within each repo using it. Any suggestions? – Ashley Jan 17 '19 at 16:06
You could use the `GET /orgs/:org/repos` endpoint to get all repos in your org, and then use `GET /repos/:owner/:repo/branches` to get all branches of that repo. Then, combine this with `PUT /repos/:owner/:repo/branches/:branch/protection` to protect all branches of all repos in your org. Does that make sense? – Adil B Jan 18 '19 at 04:12

score 1 · Answer 4 · answered Apr 17 '23 at 18:38

You now (Apr. 2023) have the notion of rulesets:

Rulesets are available in public repositories with GitHub Free and GitHub Free for organizations, and in public and private repositories with GitHub Pro, GitHub Team, and GitHub Enterprise Cloud.

That should allow you to define and enforce rules for all repositories within an organization.

Enable branch protection rules in Github at the Organisation level

4 Answers4

Linked

Related