From 02f3d811604877ab6c5deaf704e9054746020d8e Mon Sep 17 00:00:00 2001 From: Praphull <1288395+praphull-purohit@users.noreply.github.com> Date: Wed, 3 Sep 2025 15:28:41 +0200 Subject: [PATCH 1/9] Add block creations field to github branch protection scaffolder action Signed-off-by: Praphull <1288395+praphull-purohit@users.noreply.github.com> --- .../src/actions/gitHelpers.ts | 3 +++ .../src/actions/githubBranchProtection.ts | 3 +++ .../src/actions/inputProperties.ts | 9 +++++++++ 3 files changed, 15 insertions(+) diff --git a/plugins/scaffolder-backend-module-github/src/actions/gitHelpers.ts b/plugins/scaffolder-backend-module-github/src/actions/gitHelpers.ts index c720690ee6..d7ef3496dd 100644 --- a/plugins/scaffolder-backend-module-github/src/actions/gitHelpers.ts +++ b/plugins/scaffolder-backend-module-github/src/actions/gitHelpers.ts @@ -44,6 +44,7 @@ type BranchProtectionOptions = { dismissStaleReviews?: boolean; requiredCommitSigning?: boolean; requiredLinearHistory?: boolean; + blockCreations?: boolean; }; export const enableBranchProtectionOnDefaultRepoBranch = async ({ @@ -64,6 +65,7 @@ export const enableBranchProtectionOnDefaultRepoBranch = async ({ dismissStaleReviews = false, requiredCommitSigning = false, requiredLinearHistory = false, + blockCreations = false, }: BranchProtectionOptions): Promise => { const tryOnce = async () => { try { @@ -96,6 +98,7 @@ export const enableBranchProtectionOnDefaultRepoBranch = async ({ }, required_conversation_resolution: requiredConversationResolution, required_linear_history: requiredLinearHistory, + block_creations: blockCreations, }); if (requiredCommitSigning) { diff --git a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts index f82bfc6950..6ae0f67135 100644 --- a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts +++ b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts @@ -57,6 +57,7 @@ export function createGithubBranchProtectionAction(options: { requireLastPushApproval: inputProps.requireLastPushApproval, requiredCommitSigning: inputProps.requiredCommitSigning, requiredLinearHistory: inputProps.requiredLinearHistory, + blockCreations: inputProps.blockCreations, token: inputProps.token, }, }, @@ -76,6 +77,7 @@ export function createGithubBranchProtectionAction(options: { requireLastPushApproval = false, requiredCommitSigning = false, requiredLinearHistory = false, + blockCreations = false, token: providedToken, } = ctx.input; @@ -129,6 +131,7 @@ export function createGithubBranchProtectionAction(options: { dismissStaleReviews, requiredCommitSigning, requiredLinearHistory, + blockCreations, }); }, }); diff --git a/plugins/scaffolder-backend-module-github/src/actions/inputProperties.ts b/plugins/scaffolder-backend-module-github/src/actions/inputProperties.ts index e1df40f85d..bfa232c45d 100644 --- a/plugins/scaffolder-backend-module-github/src/actions/inputProperties.ts +++ b/plugins/scaffolder-backend-module-github/src/actions/inputProperties.ts @@ -348,6 +348,14 @@ const requiredLinearHistory = (z: typeof zod) => }) .optional(); +const blockCreations = (z: typeof zod) => + z + .boolean({ + description: `Prevents creation of new branches during push, unless the push is initiated by a user, team, or app (defined in restrictions) which has the ability to push.`, + }) + .default(false) + .optional(); + const repoVariables = (z: typeof zod) => z .record(z.string(), { @@ -449,4 +457,5 @@ export { protectEnforceAdmins, bypassPullRequestAllowances, branch, + blockCreations, }; From 6393b78fe4115cda68b1f1ff5a6805acc4f26413 Mon Sep 17 00:00:00 2001 From: Praphull <1288395+praphull-purohit@users.noreply.github.com> Date: Wed, 3 Sep 2025 15:38:25 +0200 Subject: [PATCH 2/9] Add changeset Signed-off-by: Praphull <1288395+praphull-purohit@users.noreply.github.com> --- .changeset/ripe-boxes-stand.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/ripe-boxes-stand.md diff --git a/.changeset/ripe-boxes-stand.md b/.changeset/ripe-boxes-stand.md new file mode 100644 index 0000000000..e40dedbe90 --- /dev/null +++ b/.changeset/ripe-boxes-stand.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-scaffolder-backend-module-github': minor +--- + +Add field block_creations in github branch protection scaffolder actions From f2be6858aef081fc37bc11dec20d110da6d97af3 Mon Sep 17 00:00:00 2001 From: Praphull <1288395+praphull-purohit@users.noreply.github.com> Date: Wed, 3 Sep 2025 15:40:51 +0200 Subject: [PATCH 3/9] Update tests Signed-off-by: Praphull <1288395+praphull-purohit@users.noreply.github.com> --- .../src/actions/githubBranchProtection.test.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.test.ts b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.test.ts index d20a02d460..98d296e176 100644 --- a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.test.ts +++ b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.test.ts @@ -105,6 +105,7 @@ describe('github:branch-protection:create', () => { }, required_conversation_resolution: false, required_linear_history: false, + block_creations: false, }); expect( mockOctokit.rest.repos.createCommitSignatureProtection, @@ -142,6 +143,7 @@ describe('github:branch-protection:create', () => { }, required_conversation_resolution: false, required_linear_history: false, + block_creations: false, }); expect( mockOctokit.rest.repos.createCommitSignatureProtection, @@ -178,6 +180,7 @@ describe('github:branch-protection:create', () => { requireLastPushApproval: true, requiredCommitSigning: true, requiredLinearHistory: true, + blockCreations: true, }, }); @@ -211,6 +214,7 @@ describe('github:branch-protection:create', () => { }, required_conversation_resolution: true, required_linear_history: true, + block_creations: true, }); expect( mockOctokit.rest.repos.createCommitSignatureProtection, From 172d57c6b02afa8fec1c5c70c7fca0c734ba99bd Mon Sep 17 00:00:00 2001 From: Praphull <1288395+praphull-purohit@users.noreply.github.com> Date: Wed, 3 Sep 2025 15:51:33 +0200 Subject: [PATCH 4/9] Add API Report Signed-off-by: Praphull <1288395+praphull-purohit@users.noreply.github.com> --- plugins/scaffolder-backend-module-github/report.api.md | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/scaffolder-backend-module-github/report.api.md b/plugins/scaffolder-backend-module-github/report.api.md index 85ca128c34..35e4e71c3c 100644 --- a/plugins/scaffolder-backend-module-github/report.api.md +++ b/plugins/scaffolder-backend-module-github/report.api.md @@ -81,6 +81,7 @@ export function createGithubBranchProtectionAction(options: { requireLastPushApproval?: boolean | undefined; requiredCommitSigning?: boolean | undefined; requiredLinearHistory?: boolean | undefined; + blockCreations?: boolean | undefined; token?: string | undefined; }, { From 2f79f0bac84b762651a4aa2d410d564e79efa1ad Mon Sep 17 00:00:00 2001 From: Praphull <1288395+praphull-purohit@users.noreply.github.com> Date: Wed, 3 Sep 2025 15:54:59 +0200 Subject: [PATCH 5/9] Fix tests in examples Signed-off-by: Praphull <1288395+praphull-purohit@users.noreply.github.com> --- .../src/actions/githubBranchProtection.examples.test.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.examples.test.ts b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.examples.test.ts index 31a15f6019..b02d451992 100644 --- a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.examples.test.ts +++ b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.examples.test.ts @@ -99,6 +99,7 @@ describe('github:branch-protection:create', () => { }, required_conversation_resolution: false, required_linear_history: false, + block_creations: false, }); expect( mockOctokit.rest.repos.createCommitSignatureProtection, @@ -132,6 +133,7 @@ describe('github:branch-protection:create', () => { }, required_conversation_resolution: false, required_linear_history: false, + block_creations: false, }); expect( mockOctokit.rest.repos.createCommitSignatureProtection, @@ -165,6 +167,7 @@ describe('github:branch-protection:create', () => { }, required_conversation_resolution: true, required_linear_history: false, + block_creations: false, }); expect( mockOctokit.rest.repos.createCommitSignatureProtection, @@ -202,6 +205,7 @@ describe('github:branch-protection:create', () => { }, required_conversation_resolution: true, required_linear_history: true, + block_creations: false, }); expect( mockOctokit.rest.repos.createCommitSignatureProtection, From a599afa296384a1e39cd7db866593265128a27ef Mon Sep 17 00:00:00 2001 From: Praphull <1288395+praphull-purohit@users.noreply.github.com> Date: Wed, 3 Sep 2025 15:57:14 +0200 Subject: [PATCH 6/9] Minor correction in changeset Signed-off-by: Praphull <1288395+praphull-purohit@users.noreply.github.com> --- .changeset/ripe-boxes-stand.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/ripe-boxes-stand.md b/.changeset/ripe-boxes-stand.md index e40dedbe90..163f5ae545 100644 --- a/.changeset/ripe-boxes-stand.md +++ b/.changeset/ripe-boxes-stand.md @@ -2,4 +2,4 @@ '@backstage/plugin-scaffolder-backend-module-github': minor --- -Add field block_creations in github branch protection scaffolder actions +Add field blockCreations in github branch protection scaffolder actions From da404afd70598dbe54dbc261ef14b3a6b2ad1425 Mon Sep 17 00:00:00 2001 From: Praphull <1288395+praphull-purohit@users.noreply.github.com> Date: Fri, 5 Sep 2025 09:20:53 +0200 Subject: [PATCH 7/9] Incorporate code review suggestion Signed-off-by: Praphull <1288395+praphull-purohit@users.noreply.github.com> --- .changeset/ripe-boxes-stand.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/ripe-boxes-stand.md b/.changeset/ripe-boxes-stand.md index 163f5ae545..f76f7b2516 100644 --- a/.changeset/ripe-boxes-stand.md +++ b/.changeset/ripe-boxes-stand.md @@ -2,4 +2,4 @@ '@backstage/plugin-scaffolder-backend-module-github': minor --- -Add field blockCreations in github branch protection scaffolder actions +Add block creations field in github branch protection scaffolder actions From 0ab3ae36541e8beee0a9f52ac8e323268833e14d Mon Sep 17 00:00:00 2001 From: Praphull Purohit <1288395+praphull-purohit@users.noreply.github.com> Date: Tue, 9 Sep 2025 16:10:01 +0200 Subject: [PATCH 8/9] Change from minor to patch Co-authored-by: Paul Schultz Signed-off-by: Praphull Purohit <1288395+praphull-purohit@users.noreply.github.com> --- .changeset/ripe-boxes-stand.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/ripe-boxes-stand.md b/.changeset/ripe-boxes-stand.md index f76f7b2516..9a1e72f052 100644 --- a/.changeset/ripe-boxes-stand.md +++ b/.changeset/ripe-boxes-stand.md @@ -1,5 +1,5 @@ --- -'@backstage/plugin-scaffolder-backend-module-github': minor +'@backstage/plugin-scaffolder-backend-module-github': patch --- Add block creations field in github branch protection scaffolder actions From 02110671648a8cd8de00c57c5fd622c5e445a856 Mon Sep 17 00:00:00 2001 From: Praphull Purohit <1288395+praphull-purohit@users.noreply.github.com> Date: Tue, 9 Sep 2025 16:10:28 +0200 Subject: [PATCH 9/9] Remove blockCreations defaulting Apply suggestion from @schultzp2020 Co-authored-by: Paul Schultz Signed-off-by: Praphull Purohit <1288395+praphull-purohit@users.noreply.github.com> --- .../src/actions/githubBranchProtection.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts index 6ae0f67135..ee8555661b 100644 --- a/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts +++ b/plugins/scaffolder-backend-module-github/src/actions/githubBranchProtection.ts @@ -77,7 +77,7 @@ export function createGithubBranchProtectionAction(options: { requireLastPushApproval = false, requiredCommitSigning = false, requiredLinearHistory = false, - blockCreations = false, + blockCreations, token: providedToken, } = ctx.input;