3 ms·

This kind of situation has been one of my concerns about deploying git internally in a large corporate environment. What steps are appropriate to block this ki

by mey 13y ago

This kind of situation has been one of my concerns about deploying git internally in a large corporate environment. What steps are appropriate to block this kind of update on a central repo? I don't see a human patch manager scaling.

nonchalance 13y ago
The old-school way (cronjob + tarball) works well. A modern alternative is only allow a bot to write to the central repo. As an example, the rust guys use a bot: https://github.com/mozilla/rust/pull/10403 https://github.com/mozilla/rust/pull/10403
potch 13y ago
If you set up a git server yourself, you can disable --force pushes globally: http://randyfay.com/content/avoiding-git-disasters-gory-story http://randyfay.com/content/avoiding-git-disasters-gory-stor...
dubcanada 13y ago
An easy way to do this is to use the fork/pull request part with a build bot to push commits to the actual master once approved. That way nobody has access to the main repo, all they can do is pull request in, and you can do what ever you want to your own fork.
qznc 13y ago
We have often inexperienced students, who do get push permission to our central repos. So far they all behaved reasonable, however we had one accident. The student used Eclipse with its git integration. He tried to push, but it failed (non-fast-forward). Apparently, Eclipse tries to be helpful and says something like "If you want to push anyways, use the 'force' checkbox". Not knowing what a "force push" is, the student followed Eclipse's advice. Thankfully, the distributed nature of git is very helpful. You can just force push again from another repo to undo the force push.
- andor 13y ago
  Yes! Eclipse's JGit is afwul. I did a project with 9 others inexperienced in Git. In the final crunch phase, they managed to delete commits via force push multiple times a day! JGit also completely messed up the history with merge commits, instead of doing fetch and rebase.
pepve 13y ago
We use Gitolite (http://gitolite.com/gitolite/index.html http://gitolite.com/gitolite/index.html). It can be configured to block (force) pushes for repositories, branches or persons, among other things.

by mey 13y ago

nonchalance 13y ago

The old-school way (cronjob + tarball) works well. A modern alternative is only allow a bot to write to the central repo. As an example, the rust guys use a bot: https://github.com/mozilla/rust/pull/10403 https://github.com/mozilla/rust/pull/10403

potch 13y ago

If you set up a git server yourself, you can disable --force pushes globally: http://randyfay.com/content/avoiding-git-disasters-gory-story http://randyfay.com/content/avoiding-git-disasters-gory-stor...

dubcanada 13y ago

An easy way to do this is to use the fork/pull request part with a build bot to push commits to the actual master once approved. That way nobody has access to the main repo, all they can do is pull request in, and you can do what ever you want to your own fork.

qznc 13y ago

We have often inexperienced students, who do get push permission to our central repos. So far they all behaved reasonable, however we had one accident. The student used Eclipse with its git integration. He tried to push, but it failed (non-fast-forward). Apparently, Eclipse tries to be helpful and says something like "If you want to push anyways, use the 'force' checkbox". Not knowing what a "force push" is, the student followed Eclipse's advice. Thankfully, the distributed nature of git is very helpful. You can just force push again from another repo to undo the force push.

andor 13y ago
Yes! Eclipse's JGit is afwul. I did a project with 9 others inexperienced in Git. In the final crunch phase, they managed to delete commits via force push multiple times a day! JGit also completely messed up the history with merge commits, instead of doing fetch and rebase.

pepve 13y ago

We use Gitolite (http://gitolite.com/gitolite/index.html http://gitolite.com/gitolite/index.html). It can be configured to block (force) pushes for repositories, branches or persons, among other things.