4 ms·

What does "Disable the ability to fork repos in your organization" do? Isn't that entirely defeated by users changing the origin?

lelandfe 3y ago
Yes, it's just lip service. The moment you've cloned a repo to your computer, you have "forked" it. It's simply the nature of decentralized version control.
cj 3y ago
It prevents it from happening in the GitHub UI. Of course it’s still possible to download the code and upload it to a separate repo (but then it’s not a fork).
- hedora 3y ago
  Of course bypassing the UI means that normal development flows (like force rebasing, or futzing with the CI setup) now are the same set of commands as malicious exfiltration of source code. It also breaks GitHub's normal protection against accidentally creating public forks of private repos (and the feature where it auto-deletes your private forks when you change jobs). There are probably other ways in which disabling private forks undermines your organization's security, but those are pretty obvious.
  - cj 3y ago
    (Genuine question) what is a use case where an employee needs to fork your company’s repo rather than open a PR? The only one I can think of is what you mentioned (testing CI workflows that match a branch name) but at least at our company that can usually be done in a PR. I don’t see any obvious reason why an employee would ever need to fork a company’s private repo to their personal GitHub account.
    - owl57 3y ago
      > I don’t see any obvious reason why an employee would ever need to fork a company’s private repo to their personal GitHub account. I don't see it as well, but Github docs seem to suggest that forking a private repo inside the same org is allowed/forbidden by the same setting?
    - edgyquant 3y ago
      For large projects this can happen. Think the Linux forks that AMD etc maintain and then regularly do a series of PRs to integrate them into some staging branch which then makes its way to the kernel if approved. It’s a typical workflow for inter-org codebase.
      - halostatue 3y ago
        Those are public repositories. I do not see the benefit of forking private repositories and have disabled it in the company org that I manage.
    - flerchin 3y ago
      Every single clone is a fork. I feel like you're missing the fundamental concept of git as a DVCS.
      - howinteresting 3y ago
        They clearly mean fork in the GitHub UI, not fork as in running git clone locally.
      - cj 3y ago
        GitHub support disagrees: https://github.com/orgs/community/discussions/35849 https://github.com/orgs/community/discussions/35849 Clone = copy of code that you can sync with the remote on GitHub Fork = copy of code that isn’t connected to the original remote. Of course, every fork involves a clone. But not every clone is a fork. I could be wrong, but “fork” isn’t really a concept native to Git. https://en.m.wikipedia.org/wiki/Fork_(software_development) https://en.m.wikipedia.org/wiki/Fork_(software_development)

lelandfe 3y ago

Yes, it's just lip service. The moment you've cloned a repo to your computer, you have "forked" it. It's simply the nature of decentralized version control.

cj 3y ago

It prevents it from happening in the GitHub UI. Of course it’s still possible to download the code and upload it to a separate repo (but then it’s not a fork).

hedora 3y ago
Of course bypassing the UI means that normal development flows (like force rebasing, or futzing with the CI setup) now are the same set of commands as malicious exfiltration of source code. It also breaks GitHub's normal protection against accidentally creating public forks of private repos (and the feature where it auto-deletes your private forks when you change jobs). There are probably other ways in which disabling private forks undermines your organization's security, but those are pretty obvious.
- cj 3y ago
  (Genuine question) what is a use case where an employee needs to fork your company’s repo rather than open a PR? The only one I can think of is what you mentioned (testing CI workflows that match a branch name) but at least at our company that can usually be done in a PR. I don’t see any obvious reason why an employee would ever need to fork a company’s private repo to their personal GitHub account.
  - owl57 3y ago
    > I don’t see any obvious reason why an employee would ever need to fork a company’s private repo to their personal GitHub account. I don't see it as well, but Github docs seem to suggest that forking a private repo inside the same org is allowed/forbidden by the same setting?
  - edgyquant 3y ago
    For large projects this can happen. Think the Linux forks that AMD etc maintain and then regularly do a series of PRs to integrate them into some staging branch which then makes its way to the kernel if approved. It’s a typical workflow for inter-org codebase.
    - halostatue 3y ago
      Those are public repositories. I do not see the benefit of forking private repositories and have disabled it in the company org that I manage.
  - flerchin 3y ago
    Every single clone is a fork. I feel like you're missing the fundamental concept of git as a DVCS.
    - howinteresting 3y ago
      They clearly mean fork in the GitHub UI, not fork as in running git clone locally.
    - cj 3y ago
      GitHub support disagrees: https://github.com/orgs/community/discussions/35849 https://github.com/orgs/community/discussions/35849 Clone = copy of code that you can sync with the remote on GitHub Fork = copy of code that isn’t connected to the original remote. Of course, every fork involves a clone. But not every clone is a fork. I could be wrong, but “fork” isn’t really a concept native to Git. https://en.m.wikipedia.org/wiki/Fork_(software_development) https://en.m.wikipedia.org/wiki/Fork_(software_development)