Repository Rules GA Feedback #61107
Replies: 69 comments 171 replies
-
|
For the use case of exempting bots, how do I exempt commits using the default GitHub Actions token from a workflow? |
Beta Was this translation helpful? Give feedback.
-
|
Looks like when comparing to Branch Protection, it is currently missing the |
Beta Was this translation helpful? Give feedback.
-
|
Is it possible to have access control rules for each repo? For example, each repo should not have more than 10 users with admin permission |
Beta Was this translation helpful? Give feedback.
-
|
What happened to the standard "branch protection" that was available in the menu previously and the related API (aka does the branch protection API work the same or creates a rule in the background - /repos/(owner)/(repo)/branches/(branch)/protection ). This seems to be the feature for newly created repositories and it creates some UI inconsistencies people get confused about. Will any migration from the "branch protection" settings into a "branch protection rule" happen or is it up to the repo owners to manage the transition by themselves? We're using the enterprise cloud subscription and have automation in scripts that seems is broken so we're doing a root cause investigation and noticed the Changelog + Blog Post and missing UI settings, but no detailed info anywhere. Anyone having the same issue? |
Beta Was this translation helpful? Give feedback.
-
|
I've found a use case where the PR checks are not working I get 422 error |
Beta Was this translation helpful? Give feedback.
-
|
Would it be possible to introduce rules around how PRs are merged via these rulesets? For example, using a ruleset to enforce across multiple repositories that PRs must be merged via a squash and merge strategy. As far as I can tell this setting is still only available at the repository level which means we have to configure it in all relevant repos individually rather than applying it on a ruleset that applies to a specific list of repos. It is currently possible to restrict to either rebase merge or squash merge via requiring linear history, but for repos defining infrastructure as code we prefer squash and merge and to disable rebase merge so that commit messages all refer back to their relevant pull request when commit messages are sent to audit logs of deployments elsewhere. Other than that the new feature is amazing, I was worried I’d have to start diving into managing repos via terraform which is a layer of complexity I’m happy to avoid. This in combination with template repos is very powerful. |
Beta Was this translation helpful? Give feedback.
-
|
Question on rule behavior, I created a rule that has "Repository admin" in the bypass list and the option "Restrict updates" enabled. Pull Requests are blocked, even though I am a repository admin, is this expected? Is this supposed to be the same as the branch protection rule "Restrict who can push to matching branches"? |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
I'm looking to enforce approvals for PRs. 1 approval org-wide. However, we have repositories that have already configured 2 approvals. Will it be overwritten? Will we still be able to configure higher approvals for specific branches? |
Beta Was this translation helpful? Give feedback.
-
|
Can we get the opposite of an exemption list, like an application list? For instance, I want some checks to apply ONLY to certain groups of people... |
Beta Was this translation helpful? Give feedback.
-
|
We just tried to enable Is there a way for us to have this setting, but only for commits not in the main branch? Or some other similar requirement. If not, would you consider it for the roadmap in a future iteration? |
Beta Was this translation helpful? Give feedback.
-
|
What is the state of the merge queue support? Is this something on the near term roadmap or a technical challenge which will require quite some time to implement? |
Beta Was this translation helpful? Give feedback.
-
|
I am not able to add Edit: I checked via the developer option, and it gives a |
Beta Was this translation helpful? Give feedback.
-
|
Can someone help me with to bypass branch projection rules? I have already checked a post but did not worked out. Edit: I am trying to apply for my personal pro account What I done is:
Still I could not bypass it |
Beta Was this translation helpful? Give feedback.
-
|
are there any plans to make org-wide rulesets available with a github team plan? i'm the only member of my organization. i don't want to be forced into an enterprise plan, especially with required workflows moving to repository rules. |
Beta Was this translation helpful? Give feedback.
-
|
After implementing the setup described in this post
We can no longer add PRs to the MergeQueue via API ( {
"data": {
"enqueuePullRequest": null
},
"errors": [
{
"type": "UNPROCESSABLE",
"path": [
"enqueuePullRequest"
],
"locations": [
{
"line": 9,
"column": 3
}
],
"message": "Pull request Waiting on code owner review from myOrg/myTeam."
}
]
}Is returned even though |
Beta Was this translation helpful? Give feedback.
-
|
Feedback on "Require status checks to pass": searching for a check is hard. If I want to know what options are available, I have to start typing before I get information. And that you have to type is not even clear from the UI. I was breaking my head for ten minutes trying to figure out why my test was not visible (was it to old to show up, did I misconfigure something). This should a) be better to understand and b) just fill the list when I click on the dropdown! |
Beta Was this translation helpful? Give feedback.
-
|
HI! This is a great feature, but I'm wondering if it would be possible to show the user the rule description in addition to, or instead of, the regex rule? Regex can be pretty difficult to decipher and it would be helpful to be able to tell our contributors what we're expecting in plain language. For example, if I want to enforce a slash in their branch name with something like |
Beta Was this translation helpful? Give feedback.
-
|
When a repository ruleset prevents a pull request from being merged and auto-merge is enabled on the pull request, disabling the ruleset does not trigger the auto-merge of the the pull request, despite there no longer being a blocking restriction. Are there intentions for auto-merge to be triggered by repository rules, or will it only respect branch protection rules? |
Beta Was this translation helpful? Give feedback.
-
|
Hi Team, Workaround I tried
Request:
Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Is it possible to require status checks to pass only when certain files have been modified? Dependabot will post a check run when For fully internal apps, it's possible to adjust but not really an option for external provided checks. |
Beta Was this translation helpful? Give feedback.
-
|
Is there any way to require a review from a specific team without using CODEOWNERS? We want to require that certain contributors (e.g. external contractors or new hires) require a review from a more senior developer before their changes can be merged. However, we don't want to use a CODEOWNERS setup as (as far as we can tell) that would result in all of us being assigned as a reviewer on every PR, including ones made by automated tools (such as Dependabot or Renovate). It would be awesome if there was a setting for "Require approval from", where you could select any team(s) / apps / etc. that you require, without needing to go through a CODEOWNERS file. That way we could require that there is an approval from a specified team without auto-assigning them to every PR. Plus it would make it easier to have different approval requirements for different branches (i.e. Team A needs to approve merge into QA, but Team B needs to approve a merge into production) without needing to somehow keep CODEOWNERS from merging between branches as well. Alternately, if there's some setting I don't know about to only auto-request CODEOWNERS review on certain target branches, that would also be perfect. Yes I know the CODEOWNERS file is read per-branch, but we use a branching workflow and try to keep all of them as in-sync as possible, so there's no good way for us to keep different CODEOWNERS on different branches. To hopefully head-off certain follow-up questions:
|
Beta Was this translation helpful? Give feedback.
-
|
please i need to confirm if branch protection rules are still available for free on personal accounts |
Beta Was this translation helpful? Give feedback.
-
|
Repository Rules sound like a real game-changer, especially for teams managing multiple collaborators and repos. The ability to enforce consistent policies across branches and tags is going to make things way more streamlined, especially for larger organizations where governance and compliance matter. Personally, I love the evaluation mode idea — being able to dry-run a rule before enforcing it gives teams a safe space to experiment and refine without disrupting active workflows. That’s such a thoughtful feature. Looking forward to exploring this more. Also, appreciate that known issues were clearly mentioned — transparency like this really helps teams plan better. Curious to see when merge queue support will be added. 🙌 Thanks again for shipping this — can’t wait to dive in! |
Beta Was this translation helpful? Give feedback.
-
|
I'd be interested in seeing the ability to add a rule for PR approvals that requires a minimum period of time between the approval (without an intervening rejection) and being merged, similarily to "Final Comment Periods" used by the Rust project. Having this builtin would be nice rather than having to track the timer out of band. |
Beta Was this translation helpful? Give feedback.
-
|
does an "org admin" role inherently assume a "repo admin" role? (in the context of repos, yes; but also in the context of rulesets?) i've created a ruleset with bypass for "repo admin" role, but am able to see the "bypass rules" checkbox on a repo, as an "org admin". i am NOT a "repo admin" on the repo targeted by the ruleset. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
This comment was marked as spam.
This comment was marked as spam.
-
|
all the api endpoints needing '"Administration" organization permissions (write)' is a little weird. i'd suggest downgrading a few of these permissions to "(read)" for safety reasons. the current options i have are a. either, creating a separate standalone fine-grained token and mgmt; https://docs.github.com/en/rest/orgs/rules?apiVersion=2022-11-28
https://docs.github.com/en/rest/repos/rule-suites?apiVersion=2022-11-28
|
Beta Was this translation helpful? Give feedback.
-
|
the "Get a repository rule suite" does not work for org rule suites when using the ID from "Get all organization repository rulesets", the endpoint fails with a 500, and message "Client error '404 Not Found' for url 'GET https://api.github.com/orgs/{{ORG}}/rulesets/rule-suites/{{ID}}'" |
Beta Was this translation helpful? Give feedback.


















Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hey, Y'all!
I’m excited to announce that Repository Rules are now Generally Available! 🎉
❓ What does this mean?
Repository Rules are an evolution of our branch and tag protections, designed to scale more efficiently. These rules make it easier to protect branches and tags in your repositories and allow everyone collaborating on a repository to understand the rules more readily.
For GitHub Enterprise Cloud customers, you can enforce these rules across your entire organization, ensuring consistency and security. Plus, there's an evaluation mode that lets you try these rules in a 'dry run', helping you understand the impact of new rules before they become active.
📑 Want to learn more? Here are some resources:
❔ Still have queries?
💯 A massive thank you to everyone in the community, the feedback and engagement has been invaluable.
🐛 Known issues:
Some of the more common or noteworthy issues we are tracking:
Only Organization owners can create and manage organization rulesets.There are now org customer roles which include a role for rulesets.No merge queue support at the momentNow GA!Beta Was this translation helpful? Give feedback.
All reactions