How to restrict who can merge to master on a github repo?

Question

I have setup on my Github repo a branch protection rule on master branch checking (activating) the following:

• Require pull request reviews before merging
• Required approving reviewers : 1
• Include administrators
• Restrict who can push to matching branches

I'm then in a situation that at least one from the team must approve a PR before someone can merge its own dev branch to master.

Apart from the above I would also want to select only some people that will have the permission to merge the reviewed and approved PR. Not everyone having access to the repo.

Is it possible to set this up?

Answer 1

No, GitHub doesn't let you restrict who can perform a merge. However, if you want to require a specific group of people to approve a PR before merging, use the CODEOWNERS file and require an approval from a code owner before merging in the branch protection settings.

For example, if you want all changes to be reviewed by the core team, you can use this in your CODEOWNERS file:

*  @my-org/core

Answer 2

I also have requirement like you that I only want some specific people (not all collaborators) are allowed to approve changes to the main branch. And I did as follows for Github Free public repository:

• write a Github Actions file that check the name of person who runs it. If this is name of powerful collaborator, the Actions will succeed.

name: actions_on_main_branch
on: 
  pull_request_target:
    types:
      - opened
      - synchronize
      - reopened
    branches:    
      - 'main'

jobs:
  job1:
    name: check_adminA
    runs-on: ubuntu-latest
    env:
      NAME_ADMIN: adminA
    steps:
      - name: st1
        if: ${{ github.actor != env.NAME_ADMIN }}
        run: exit 1
      - name: st2
        if: ${{ github.actor == env.NAME_ADMIN }}
        run: echo "ok"

• in repo settings, add rule to protect 'main' branch. in that rule, select 'Require status checks to pass before merging' and select jobs that you specified previously in github actions file. (if jobs not showing, try creating pull request that trigger those github actions, after that jobs will be found on search bar) (you can also select 'Include administrators')

  

By doing that, changes are made to 'main' branch have to go through pull request and those checks will run and fail and prevent merging. Until the powerful collaborators (adminA, adminB) go to that pull request and re-run them, those checks succeeds and allows merging.
(The pull_request_target event makes Github-actions run on the context of base branch instead of the merging branch. So you don't have to worry github-actions file are edited to be passed easily from outside.)

Answer 3

Merging of pull requests respect the branch protection rule of the target branch. So add the people who should be allowed to merge into the protection rule and you are good to go.

Answer 4

It is posible by 'Branch protection rules':

You have to select the branch you want to protect and select the people allow to merge in this option:

Answer 5

I recall at least half of those features are in GitHub's settings. In your case, only approvers should be added as "collaborators", since they can push. Other users will have to open a pull request to make any change.

Answer 6

@irous I followed your answer and it work for a single user, but then trying to specify for more than one user it is then required that the two specified collaborators must pass before a PR merge. Below is the added script:

  job1:
name: check_adminA
runs-on: ubuntu-latest
env:
  NAME_ADMIN1: pracin
steps:
  - name: st1
    if: ${{ github.actor != env.NAME_ADMIN1 }}
    run: exit 1
  - name: st2
    if: ${{ github.actor == env.NAME_ADMIN1 }}
    run: echo "ok"
job2:
name: check_adminB
runs-on: ubuntu-latest
env:
  NAME_ADMIN2: stephus
steps:
  - name: st1
    if: ${{ github.actor != env.NAME_ADMIN2 }}
    run: exit 1
  - name: st2
    if: ${{ github.actor == env.NAME_ADMIN2 }}
    run: echo "ok"