Branch protection rules are not working anymore. #625

dgokcin · 2022-08-01T09:14:28Z

Problem Description

I just created a new repository with the same config file that I use for all of my repositories and noticed that although the configs are the same, branch protection rules are not working. Any help is appreciated. To reproduce, you can try creating a new repo from the default settings in the README file. I am attaching my current config below

# These settings are synced to GitHub by https://probot.github.io/apps/settings/

repository:
  # See https://docs.github.com/en/rest/reference/repos#update-a-repository for all available settings.

  # The name of the repository. Changing this will rename the repository
  name: store-api

  # A short description of the repository that will show up on GitHub
  description: Store related apis

  # A URL with more information about the repository
  homepage: https://example.github.io/

  # A comma-separated list of topics to set on the repository
  topics: store, marketplace-integration, order

  # Either `true` to make the repository private, or `false` to make it public.
  private: true

  # Either `true` to enable issues for this repository, `false` to disable them.
  has_issues: false

  # Either `true` to enable projects for this repository, or `false` to disable them.
  # If projects are disabled for the organization, passing `true` will cause an API error.
  has_projects: false

  # Either `true` to enable the wiki for this repository, `false` to disable it.
  has_wiki: false

  # Either `true` to enable downloads for this repository, `false` to disable them.
  has_downloads: false

  # Updates the default branch for this repository.
  default_branch: develop

  # Either `true` to allow squash-merging pull requests, or `false` to prevent
  # squash-merging.
  allow_squash_merge: false

  # Either `true` to allow merging pull requests with a merge commit, or `false`
  # to prevent merging pull requests with merge commits.
  allow_merge_commit: true

  # Either `true` to allow rebase-merging pull requests, or `false` to prevent
  # rebase-merging.
  allow_rebase_merge: false

  # Either `true` to enable automatic deletion of branches on merge, or `false` to disable
  delete_branch_on_merge: false

  # Either `true` to enable automated security fixes, or `false` to disable
  # automated security fixes.
  enable_automated_security_fixes: false

  # Either `true` to enable vulnerability alerts, or `false` to disable
  # vulnerability alerts.
  enable_vulnerability_alerts: false

# Labels: define labels for Issues and Pull Requests
labels:
  - name: fix
    color: '#E1A296'
    description: A label used to mark fixes for automatic release notes generation.

  - name: feature
    # If including a `#`, make sure to wrap it with quotes!
    color: '#336699'
    description: A label used to mark features for automatic release notes generation.

# Collaborators: give specific users access to this repository.
# See https://docs.github.com/en/rest/reference/repos#add-a-repository-collaborator for available options
collaborators:
  # - username: bkeepers
  #   permission: push
  # - username: hubot
  #   permission: pull

  # Note: `permission` is only valid on organization-owned repositories.
  # The permission to grant the collaborator. Can be one of:
  # * `pull` - can pull, but not push to or administer this repository.
  # * `push` - can pull and push, but not administer this repository.
  # * `admin` - can pull, push and administer this repository.
  # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
  # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.

# See https://docs.github.com/en/rest/reference/teams#add-or-update-team-repository-permissions for available options
teams:
  - name: CodeReview
    # The permission to grant the team. Can be one of:
    # * `pull` - can pull, but not push to or administer this repository.
    # * `push` - can pull and push, but not administer this repository.
    # * `admin` - can pull, push and administer this repository.
    # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
    # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
    permission: admin
  - name: DevTeam
    permission: push
  - name: PlatformTeam
    permission: admin

branches:
  - name: develop
    # https://docs.github.com/en/rest/reference/repos#update-branch-protection
    # Branch Protection settings. Set to null to disable
    protection:
      # Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
      required_pull_request_reviews:
        # The number of approvals required. (1-6)
        required_approving_review_count: 1
        # Dismiss approved reviews automatically when a new commit is pushed.
        dismiss_stale_reviews: true
        # Blocks merge until code owners have reviewed.
        require_code_owner_reviews: true
        # Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
        dismissal_restrictions:
          users: []
          teams: []
      # Required. Require status checks to pass before merging. Set to null to disable
      required_status_checks:
        # Required. Require branches to be up to date before merging.
        strict: true
        # Required. The list of status checks to require in order to merge into this branch
        contexts: ['Build & Test']
      # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
      enforce_admins: null
      # Prevent merge commits from being pushed to matching branches
      required_linear_history: null
      # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
      restrictions: null
  - name: main
    # https://docs.github.com/en/rest/reference/repos#update-branch-protection
    # Branch Protection settings. Set to null to disable
    protection:
      # Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
      required_pull_request_reviews:
        # The number of approvals required. (1-6)
        required_approving_review_count: 1
        # Dismiss approved reviews automatically when a new commit is pushed.
        dismiss_stale_reviews: true
        # Blocks merge until code owners have reviewed.
        require_code_owner_reviews: true
        # Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
        dismissal_restrictions:
          users: []
          teams: []
      # Required. Require status checks to pass before merging. Set to null to disable
      required_status_checks:
        # Required. Require branches to be up to date before merging.
        strict: true
        # Required. The list of status checks to require in order to merge into this branch
        contexts: ['Build & Test']
      # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
      enforce_admins: null
      # Prevent merge commits from being pushed to matching branches
      required_linear_history: null
      # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
      restrictions: null

m-schrepel · 2022-08-04T16:08:28Z

I am also having this issue with branch protection rules not being applied. I modified the settings.yml many times, checked the app installation many times and it is just not working.

dgokcin · 2022-08-22T14:57:01Z

any updates about this issue? it is a blocker on my way right now in using probot in all the repos in my organization. @travi sorry for mentioning you but I really want to know the status of this issue since it has been almost a month.

Thanks!

travi · 2022-09-19T21:23:21Z

sorry for the delay in investigating this, but i can confirm that branch protection itself is working correctly. however, as a result of #591, it is more likely that applying branch protection rules will be missed since it is now only attempted after successful application of the other sections.

this is especially unfortunate in the absence of #518, since it is quite difficult to understand a failure without running your own instance and having access to logs. if you are able to identify any problems with your configuration for the other sections, that is currently your best bet for unblocking branch protection settings from being applied. i hope to find some time to implement #518 soonish, which would provide far better insight into the details of config issues resulting in this blockage, but unfortunately i cannot make strong promises at this time.

dgokcin · 2022-09-20T07:06:37Z

@travi no problem. I do not understand what you meant by "applying branch protection rules will be missed since it is now only attempted after successful application of the other sections." you mean like I have something in my configuration which is causing a problem? in this case what do you think that might be?

thanks

stevie- · 2022-09-20T07:12:17Z

Is there a way to test a settings file? Like a github-action which parses the config in the same way as the probot-settings app.

dgokcin · 2022-09-20T07:20:53Z

@stevie- not that I know of. @travi my minimal configuration is prepared on top of the example in the repository README. I can confirm that only settings under branch protection rules are not working. All the other sections like repo description, labels, merge preferences etc. work.

How did you confirm that the branch protection rules were working on your test? Could you please share a config file?

Thanks

# These settings are synced to GitHub by https://probot.github.io/apps/settings/

repository:
  # See https://docs.github.com/en/rest/reference/repos#update-a-repository for all available settings.

  # The name of the repository. Changing this will rename the repository
  name: POCs

  # A short description of the repository that will show up on GitHub
  description: The source code for POCs.

  # A URL with more information about the repository
  homepage: https://example.github.io/

  # A comma-separated list of topics to set on the repository
  topics: poc, testing

  # Either `true` to make the repository private, or `false` to make it public.
  private: true

  # Either `true` to enable issues for this repository, `false` to disable them.
  has_issues: false

  # Either `true` to enable projects for this repository, or `false` to disable them.
  # If projects are disabled for the organization, passing `true` will cause an API error.
  has_projects: false

  # Either `true` to enable the wiki for this repository, `false` to disable it.
  has_wiki: false

  # Either `true` to enable downloads for this repository, `false` to disable them.
  has_downloads: false

  # Updates the default branch for this repository.
  default_branch: develop

  # Either `true` to allow squash-merging pull requests, or `false` to prevent
  # squash-merging.
  allow_squash_merge: false

  # Either `true` to allow merging pull requests with a merge commit, or `false`
  # to prevent merging pull requests with merge commits.
  allow_merge_commit: true

  # Either `true` to allow rebase-merging pull requests, or `false` to prevent
  # rebase-merging.
  allow_rebase_merge: false

  # Either `true` to enable automatic deletion of branches on merge, or `false` to disable
  delete_branch_on_merge: false

  # Either `true` to enable automated security fixes, or `false` to disable
  # automated security fixes.
  enable_automated_security_fixes: false

  # Either `true` to enable vulnerability alerts, or `false` to disable
  # vulnerability alerts.
  enable_vulnerability_alerts: false

branches:
  - name: develop
    # https://docs.github.com/en/rest/reference/repos#update-branch-protection
    # Branch Protection settings. Set to null to disable
    protection:
      # Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
      required_pull_request_reviews:
        # The number of approvals required. (1-6)
        required_approving_review_count: 2
        # Dismiss approved reviews automatically when a new commit is pushed.
        dismiss_stale_reviews: true
        # Blocks merge until code owners have reviewed.
        require_code_owner_reviews: true
        # Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
        dismissal_restrictions:
          users: []
          teams: []
      # Required. Require status checks to pass before merging. Set to null to disable
      required_status_checks:
        # Required. Require branches to be up to date before merging.
        strict: true
        # Required. The list of status checks to require in order to merge into this branch
        contexts: []
      # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
      enforce_admins: null
      # Prevent merge commits from being pushed to matching branches
      required_linear_history: null
      # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
      restrictions:
        apps: []
        users: []
        teams: []

travi · 2022-09-20T15:10:53Z

you mean like I have something in my configuration which is causing a problem?

yes, the most likely situation would be that a call to update one of the other sections in your config is failing. this would result in the call to update branch protection not happening because it is only attempted after all of the other sections complete successfully.

in this case what do you think that might be?

this is why i mentioned it being unfortunate that #518 is not in place, since that would be able to provide feedback about the failure. solving that is high on my list, but i can't promise a timeline.

in my case, i had an issue with a color code for a label with leading zeros and worked around that in travi-test/.github@17dde15. i also implemented a more official fix for this in https://github.com/repository-settings/app/releases/tag/v2.0.3. in addition, i had some conflicts between my vulnerability alerts and security fixes settings, so i defined both as enabled in travi-test/.github@9265ad3 and travi-test/.github@48fb2ca.

Could you please share a config file?

after making the above adjustments to my account-level config that is extended by my test project, i made the following change in order to re-trigger applying the project-level config and it applied the branch protection rules successfully: travi-test/settings-test@16499fc

my minimal configuration is prepared on top of the example in the repository README

i'll try to update my test config to be closer to yours when i get a chance and see if it results in any errors

travi · 2022-09-20T15:14:29Z

Is there a way to test a settings file? Like a github-action which parses the config in the same way as the probot-settings app.

there isn't currently, but it certainly could be valuable. a big part of the complexity with this is that most of the details to verify are not defined by the settings app, but rather by the APIs called by the settings app, which can change independently from the maintenance that happens within this app.

if something along these lines were to be implemented, it would need to automatically account for the expectations of the APIs. currently, i believe implementing #518 would provide better ROI, so i am prioritizing that over a file validator. i'm open to input if folks have ideas around solving the latter, though.

repository-settings/app#625 (comment)

travi · 2022-09-20T15:42:09Z

@dgokcin i just copy/pasted the config from your comment into travi-test/settings-test@05de64c and it applied successfully.

i think i would recommend removing the other sections from your config file so that branches is the only section left. that should enable you to confirm if you have a problem with the branch protection section specifically or if the problem is coming from one of the other sections. assuming that confirms that branch protection is not the problem, you can then add the other sections back one by one, along with making a change to the branch protection at the same time. if the branch protection setting does not apply with adding one of the sections back to the file, that is the one causing the error.

i know this is not ideal, but it is the best i can recommend until #518 is completed

dgokcin · 2022-09-20T16:44:13Z

after a painful hour of debugging, I found the problematic line. the enable_automated_security_fixes: false line which is also present on the README but set to true has caused probot settings to fail processing at some point and eventually causing branch protection rules to fail. I am happy to say that removing that line fixed branch protection problems in all my repositories!

travi · 2022-09-20T20:30:44Z

the enable_automated_security_fixes: false line which is also on the README has caused probot settings to fail processing

would you be interested in sending a PR to update that property to true in the readme? probably a better recommendation anyway and is the setting that worked for me. before i set both security alerts and vulnerability fixes to true (which is really the behavior i wanted anyway), i was seeing "Vulnerability alerts must be enabled to configure automated security fixes.", so there are some requirements around those being used together.

dgokcin · 2022-09-20T20:50:07Z

the enable_automated_security_fixes: false line which is also on the README has caused probot settings to fail processing

would you be interested in sending a PR to update that property to true in the readme? probably a better recommendation anyway and is the setting that worked for me. before i set both security alerts and vulnerability fixes to true (which is really the behavior i wanted anyway), i was seeing "Vulnerability alerts must be enabled to configure automated security fixes.", so there are some requirements around those being used together.

it is already set to true in the readme. and my proobot config worked fine for a while. than all of a sudden, the same config stopped working. I believe setting both of them false maybe is breaking something.

See repository-settings/app#625 (comment)

mdelapenya · 2022-09-26T14:38:05Z

Unfortunately, I'm not able to make it work with this settings.yml file, and the branch protection only works if and only if it's alone in the file. I've tried with all permutations between major blocks (teams, collaborators, milestones, labels) without success. I wonder if it's possible to debug/log what section is the one failing.

The file:

# These settings are synced to GitHub by https://probot.github.io/apps/settings/

repository:
  # See https://docs.github.com/en/rest/reference/repos#update-a-repository for all available settings.

  # The name of the repository. Changing this will rename the repository
  name: .github

  # A short description of the repository that will show up on GitHub
  description: Base repository

  # A URL with more information about the repository
  homepage: https://www.example.com

  # A comma-separated list of topics to set on the repository
  topics: settings

  # Either `true` to make the repository private, or `false` to make it public.
  private: false

  # Either `true` to enable issues for this repository, `false` to disable them.
  has_issues: true

  # Either `true` to enable projects for this repository, or `false` to disable them.
  # If projects are disabled for the organization, passing `true` will cause an API error.
  has_projects: true

  # Either `true` to enable the wiki for this repository, `false` to disable it.
  has_wiki: true

  # Either `true` to enable downloads for this repository, `false` to disable them.
  has_downloads: false

  # Updates the default branch for this repository.
  default_branch: main

  # Either `true` to allow squash-merging pull requests, or `false` to prevent
  # squash-merging.
  allow_squash_merge: true

  # Either `true` to allow merging pull requests with a merge commit, or `false`
  # to prevent merging pull requests with merge commits.
  allow_merge_commit: false

  # Either `true` to allow rebase-merging pull requests, or `false` to prevent
  # rebase-merging.
  allow_rebase_merge: false

  # Either `true` to enable automatic deletion of branches on merge, or `false` to disable
  delete_branch_on_merge: true

  # Either `true` to enable automated security fixes, or `false` to disable
  # automated security fixes.
  enable_automated_security_fixes: false

  # Either `true` to enable vulnerability alerts, or `false` to disable
  # vulnerability alerts.
  enable_vulnerability_alerts: false

# Labels: define labels for Issues and Pull Requests
# If including a `#`, make sure to wrap it with quotes!
labels:
  - name: type/bug
    color: '#CC0000'
    description: An issue with the system.

  - name: type/feature
    color: '#336699'
    description: New functionality.

  - name: low-hanging-fruit
    color: '#FFC300'
    description: Issues that are good for newcomers.

  - name: hacktoberfest-accepted
    color: '#ff0000'
    description: Pull Requests accepted for Hacktoberfest.

  - name: invalid
    color: '#C3C3C3'
    description: Not accepted or invalid for any reason.

# Collaborators: give specific users access to this repository.
# See https://docs.github.com/en/rest/reference/repos#add-a-repository-collaborator for available options
collaborators:
  - username: foo
    permission: admin
  - username: bar
    permission: triage
  - username: baaz
    permission: admin

  # Note: `permission` is only valid on organization-owned repositories.
  # The permission to grant the collaborator. Can be one of:
  # * `pull` - can pull, but not push to or administer this repository.
  # * `push` - can pull and push, but not administer this repository.
  # * `admin` - can pull, push and administer this repository.
  # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
  # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.

# See https://docs.github.com/en/rest/reference/teams#add-or-update-team-repository-permissions for available options
teams:
  # Please make sure the team already exist in the organization, as the repository-settings application is not creating them.
  # See https://github.com/repository-settings/app/discussions/639 for more information about teams and settings
  - name: core-team
    # The permission to grant the team. Can be one of:
    # * `pull` - can pull, but not push to or administer this repository.
    # * `push` - can pull and push, but not administer this repository.
    # * `admin` - can pull, push and administer this repository.
    # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
    # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
    permission: admin
  - name: a-team
    permission: pull
  - name: b-team
    permission: push

branches:
  - name: main
    # https://docs.github.com/en/rest/reference/repos#update-branch-protection
    # Branch Protection settings. Set to null to disable
    protection:
      # Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
      required_pull_request_reviews:
        # The number of approvals required. (1-6)
        required_approving_review_count: 1
        # Dismiss approved reviews automatically when a new commit is pushed.
        dismiss_stale_reviews: true
        # Blocks merge until code owners have reviewed.
        require_code_owner_reviews: true
        # Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
        dismissal_restrictions:
          users: []
          teams: []
      # Required. Require status checks to pass before merging. Set to null to disable
      required_status_checks:
        # Required. Require branches to be up to date before merging.
        strict: true
        # Required. The list of status checks to require in order to merge into this branch
        contexts: []
      # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
      enforce_admins: true
      # Prevent merge commits from being pushed to matching branches
      required_linear_history: true
      # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
      restrictions:
        apps: []
        users: []
        teams: []

dgokcin · 2022-09-26T16:52:19Z

@mdelapenya

what happens if you delete just the following lines?

enable_automated_security_fixes: false
enable_vulnerability_alerts: false

mdelapenya · 2022-09-26T17:00:00Z

@mdelapenya

what happens if you delete just the following lines?

enable_automated_security_fixes: false enable_vulnerability_alerts: false

Unfortunately nothing. See: https://github.com/tc-experiments/.github/blob/main/.github/settings.yml The branch protection is not created

arrase · 2022-10-04T12:54:08Z

same problem here, branch protection is not created

benjyiw · 2022-10-07T18:26:33Z

FWIW, I was able to fix the branch protection problem in my case by adjusting the default labels. I was using the label configuration exactly as is from the README from this project. This sounds pretty silly, but I tried removing the caterpillar emoji, and it seemed to have fixed the problem in my repos.

Orig from README:

labels:
  - name: bug
    color: CC0000
    description: An issue with the system 🐛.

And now:

labels:
  - name: bug
    color: CC0000
    description: An issue with the system.

Additionally, in my case I already had all of the security settings enabled, which others mentioned was the culprit for their problems. So that didn't seem to be causing an issue for me. Hope this information is helpful to others.

rogerluan · 2022-10-09T22:28:27Z

In my case it was definitely this setting that was malfunctioning in my repo, but perhaps also this one, the reason being (for both of them) that I am running this all on personal repositories. Hope this helps someone 💪 My tip here is to read the comments to determine whether you should be enabling a setting or not, and then also read the documentation specified in each section (that leads to github official doc websites), those helped me a lot.

rogerluan · 2022-10-09T22:34:20Z

In another repo of mine, this was the root cause of the failure. Apparently, topics cannot have spaces in them 😬

mdelapenya · 2022-10-10T10:41:15Z

Mmm, interestingly, I had an issue with the teams: there were teams that did not existed, and until creating them, the configuration failed.

History (bottom-first):

tc-experiments/.github@52ba68f worked ✅
Added the GH teams that were missing
tc-experiments/.github@d4f6742 failed 🔴

Permalink to the settings that worked: https://github.com/tc-experiments/.github/blob/52ba68fb7d505360b0137bfd89bf68a5f6bf6d49/.github/settings.yml

stevie- · 2022-10-18T09:40:29Z

We see issues when we set teams parameter. If I omit it, branch protection rules work. If I add teams, teams will be set, but branch protection is skipped.

hramos05 · 2022-10-21T20:59:08Z

I see the same as stevie-, branch protection works if there are no teams. Once teams are added (works fine as is), no branch protection is configured

kmgrime · 2022-11-07T22:16:58Z

Got this to work after some debugging and a lot of testing we had to change or remove the following stuff.

color: CC0000 <---- change this to '#CC0000'
description: An issue with the system 🐛. <---- remove the emoji
name: core <---- make sure it is the exact same name as it is in you github org and don't include org name.
branches:
name: master <---- change to main as main is GitHubs default and master is the old default
#Dont change any properties under protection except values (true / false etc), it needs the properties to parse correctly it seems. Use the one in the readme for template but fix the values pointed out above

Example to show what protection properties I talk about

protection:
      # Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
      required_pull_request_reviews:
        # The number of approvals required. (1-6)
        required_approving_review_count: 1
        # Dismiss approved reviews automatically when a new commit is pushed.
        dismiss_stale_reviews: true
        # Blocks merge until code owners have reviewed.
        require_code_owner_reviews: true
        # Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
        dismissal_restrictions:
          users: []
          teams: []
      # Required. Require status checks to pass before merging. Set to null to disable
      required_status_checks:
        # Required. Require branches to be up to date before merging.
        strict: true
        # Required. The list of status checks to require in order to merge into this branch
        contexts: []
      # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
      enforce_admins: true
      # Prevent merge commits from being pushed to matching branches
      required_linear_history: true
      # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
      restrictions:
        apps: []
        users: []
        teams: []

wknapik · 2022-11-22T17:32:26Z

Ran into this as well. Had a team with the org prefix in settings.yml and branch protection rules after that. Neither the team, nor branch protection settings were applied, until I commented out the teams section.

name: core <---- make sure it is the exact same name as it is in you github org and don't include org name.

@travi how do we reference a team from another org? We have multiple orgs and would like to reference teams across them.

mrlesmithjr · 2022-12-02T18:27:38Z

I have also spent the past day trying to figure this out but have been unsuccessful. Is it safe to assume that setting these rules is completely broken for now?

kmgrime · 2022-12-05T18:56:26Z

Ran into this as well. Had a team with the org prefix in settings.yml and branch protection rules after that. Neither the team, nor branch protection settings were applied, until I commented out the teams section.

name: core <---- make sure it is the exact same name as it is in you github org and don't include org name.

@travi how do we reference a team from another org? We have multiple orgs and would like to reference teams across them.

Have you tried ex:

teams:

name: org-name/team-read

Its very important that the .YML file is correctly structured with the right amount of indents / indentations is correct. This goes for all .yml files in my experience.

kmgrime · 2022-12-05T18:58:08Z

I have also spent the past day trying to figure this out but have been unsuccessful. Is it safe to assume that setting these rules is completely broken for now?

Could you paste your full settings.yml file here and maybe I can help as I was stuck several times myself and got to solve it.
Make sure to replace company namings and naming conventions with some random stuff. 👍

mdelapenya · 2022-12-05T21:33:29Z

A working settings.yml that works for us: https://github.com/testcontainers/testcontainers-go/blob/main/.github/settings.yml

Hopefully it helps 🤞

mrlesmithjr · 2022-12-08T14:05:19Z

@kmgrime - Here is one that I've tried

https://github.com/mrlesmithjr/ansible-nginx/blob/master/.github/settings.yml

kmgrime · 2022-12-09T09:28:44Z

Here is one that I've tried

https://github.com/mrlesmithjr/ansible-nginx/blob/master/.github/settings.yml

@mrlesmithjr - If this is the file you are running you don't have all the settings required in the file so it will not be parsed correctly. If you have settings that you don't use in the file, leave them empty instead of removing them.
There is multiple good settings files here that is complete that you can use as template from the answers in this thread, hopefully one of them could be a good starting point.
Bottom line, all settings need to be in the file for it to work, even if you don't need them - leave them blank.

Good luck 👍

dworak-dev · 2023-01-07T01:16:53Z

Hey everyone! I've been having this issue for the past couple of hours and it's driving me crazy so I decided to run my own instance to be able to look at logs:

Aside from the already mentioned problems other users suggested like @kmgrime or @benjyiw my problem was fixed after removing the dismissal_restrictions property.

As you can see in the logs:

Validation Failed: "Only organization repositories can have users and team restrictions"

There might be other properties affecting your settings.yml file related to this so be sure to take a good look.

I will finally suggest to run your own instance of the bot as it helps a lot finding the particual issue in your file. There is a good guide in the Docs deploying guide

electriquo · 2023-03-01T05:22:57Z

CC @travi
Settings Application is broken for many. Would you share your take on the issue?

Shahard2 · 2023-05-09T07:15:43Z

Is there a real fix for it?

I've tried all the things that people here mentioned.. but nothing works, Branch protection is not created.

Shahard2 · 2023-05-11T06:49:23Z

@travi

mike-carey · 2023-07-06T16:31:27Z

We had similar issues where the settings were working and then one day they stopped working for certain repos. After attempting many of the fixes suggested above, we were able to resolve our issue by omitting the enable_automated_security_fixes property. Whether we enable or disable, just having this property present seems to cause an issue. Looking at our other repos that the settings were still being applied for, the enable_automated_security_fixes was not in the settings file and thus the protections were still being applied. All other properties seem to be working fine for us including the enable_vulnerability_alerts which seems strange to me since they use similar logic in the code.

Shahard2 · 2023-07-09T07:10:08Z

We had similar issues where the settings were working and then one day they stopped working for certain repos. After attempting many of the fixes suggested above, we were able to resolve our issue by omitting the enable_automated_security_fixes property. Whether we enable or disable, just having this property present seems to cause an issue. Looking at our other repos that the settings were still being applied for, the enable_automated_security_fixes was not in the settings file and thus the protections were still being applied. All other properties seem to be working fine for us including the enable_vulnerability_alerts which seems strange to me since they use similar logic in the code.

Thank you mate,
Tried to remove enable_automated_security_fixes

Still not working for me :/

mike-carey · 2023-07-27T22:19:21Z

We had similar issues where the settings were working and then one day they stopped working for certain repos. After attempting many of the fixes suggested above, we were able to resolve our issue by omitting the enable_automated_security_fixes property. Whether we enable or disable, just having this property present seems to cause an issue. Looking at our other repos that the settings were still being applied for, the enable_automated_security_fixes was not in the settings file and thus the protections were still being applied. All other properties seem to be working fine for us including the enable_vulnerability_alerts which seems strange to me since they use similar logic in the code.

Looks like I was wrong about what was happening here. Setting enable_automated_security_fixes to true while enable_vulnerability_alerts is false seems to be the issue we had. I cannot even get a description update when I have that combination of settings.

---
repository:
  # ...
  enable_automated_security_fixes: true
  enable_vulnerability_alerts: false

^^ This does not work

mike-carey · 2023-07-27T22:30:37Z

Sorry one more update. It does look like when I set both enable_automated_security_fixes and enable_vulnerability_alerts to false, the branch protections do not get updated, but the description does get updated. Commenting out the enable_automated_security_fixes is what gets our branch protections to be updated.

---
repository:
  # ...
  enable_automated_security_fixes: false
  enable_vulnerability_alerts: false

^^ This also does not work.

If you are going to disable security features, I would leave the enable_automated_security_fixes out completely.

To summarize:

---
repository:
  # ...
  description: 'This has been changed'   # this change will not take effect
  enable_automated_security_fixes: true
  enable_vulnerability_alerts: false
branches:
  - name: main
    protection:
      # ...
      required_pull_request_reviews:
        required_approving_review_count: 2  # this change will not take effect

Neither the description nor the branch protection gets updated.

---
repository:
  # ...
  description: 'This has been changed'  # this change will take effect
  enable_automated_security_fixes: true
  enable_vulnerability_alerts: false
branches:
  - name: main
    protection:
      # ...
      required_pull_request_reviews:
        required_approving_review_count: 2  # this change will not take effect

The description is updated, but the branch protection does not get updated.

electriquo · 2023-08-10T06:42:39Z

since the issue is open for a long time without any progress and following https://github.blog/2023-07-24-github-repository-rules-are-now-generally-available/, it seems that settings app is losing relevance :(

from a quick look, rest api for ruleset is available.
let's revive this amazing app!

electriquo · 2023-09-12T09:51:06Z

Starting September 20th, 2023, users can configure their workflows using rulesets in order to run and pass in selected repositories before merging their code. On October 18th, users will no longer be able to access Actions Required Workflows and must use rulesets in its place.

probably will affect the settings app

electriquo · 2023-10-12T10:15:13Z

guys, is settings app dead?

Shahard2 · 2023-10-12T10:18:01Z

guys, is settings app dead?

looks like.......

kmgrime · 2023-10-15T20:14:30Z

Starting September 20th, 2023, users can configure their workflows using rulesets in order to run and pass in selected repositories before merging their code. On October 18th, users will no longer be able to access Actions Required Workflows and must use rulesets in its place.

probably will affect the settings app

@electriquo This ^

hwhsu1231 · 2024-02-27T11:34:41Z

Any progress of this issue? I encounter this issue as well, and couldn't solve it. The branch protection rule cannot be created by .github/settings.yml after trying all the possible solutions mentioned above.

travi · 2024-04-19T21:49:44Z

trying to clean up some duplicates, so closing this in favor of #150

short answer is that this does still work when the config is all formatted correctly and no other failures have occurred ahead of the attempt to apply the branch protection settings. #518 needs to be implemented to at least provide feedback when failures occur to give an opportunity to resolve any config problems

dgokcin added the bug label Aug 1, 2022

travi added a commit to travi-test/settings-test that referenced this issue Sep 20, 2022

ci(branches): testing config from settings issue

05de64c

repository-settings/app#625 (comment)

This comment was marked as off-topic.

Sign in to view

mdelapenya added a commit to tc-experiments/.github that referenced this issue Sep 26, 2022

fix: disable security fixes

6d830d1

See repository-settings/app#625 (comment)

rogerluan mentioned this issue Oct 9, 2022

Add rules for topics #656

Open

electriquo mentioned this issue Mar 23, 2023

Added autolinks #545

Open

rjohnson2011 mentioned this issue May 26, 2023

Use Probot to Manage Branch Protection Rules as Code department-of-veterans-affairs/va.gov-team#56437

Closed

1 task

electriquo mentioned this issue Jun 4, 2023

Branch protection not being applied #150

Open

paddyroddy mentioned this issue Oct 20, 2023

Add a set of sensible default settings UCL-MIRSG/.github#47

Merged

MarvinJWendt mentioned this issue Oct 31, 2023

Recent GitHub change breaks required workflows / branch protection rules #825

Open

travi closed this as not planned Won't fix, can't repro, duplicate, stale Apr 19, 2024

Branch protection rules are not working anymore. #625

Branch protection rules are not working anymore. #625

Comments

dgokcin commented Aug 1, 2022 • edited Loading

Problem Description

m-schrepel commented Aug 4, 2022

dgokcin commented Aug 22, 2022 • edited Loading

travi commented Sep 19, 2022 • edited Loading

dgokcin commented Sep 20, 2022

stevie- commented Sep 20, 2022

dgokcin commented Sep 20, 2022 • edited Loading

travi commented Sep 20, 2022

travi commented Sep 20, 2022

travi commented Sep 20, 2022

dgokcin commented Sep 20, 2022 • edited Loading

This comment was marked as off-topic.

travi commented Sep 20, 2022

This comment was marked as off-topic.

dgokcin commented Sep 20, 2022

mdelapenya commented Sep 26, 2022

dgokcin commented Sep 26, 2022 • edited Loading

mdelapenya commented Sep 26, 2022

arrase commented Oct 4, 2022

benjyiw commented Oct 7, 2022

rogerluan commented Oct 9, 2022

rogerluan commented Oct 9, 2022

mdelapenya commented Oct 10, 2022 • edited Loading

stevie- commented Oct 18, 2022

hramos05 commented Oct 21, 2022 • edited Loading

kmgrime commented Nov 7, 2022 • edited Loading

wknapik commented Nov 22, 2022

mrlesmithjr commented Dec 2, 2022

kmgrime commented Dec 5, 2022

kmgrime commented Dec 5, 2022

mdelapenya commented Dec 5, 2022

mrlesmithjr commented Dec 8, 2022

kmgrime commented Dec 9, 2022

dworak-dev commented Jan 7, 2023

electriquo commented Mar 1, 2023

Shahard2 commented May 9, 2023

Shahard2 commented May 11, 2023

mike-carey commented Jul 6, 2023 • edited Loading

Shahard2 commented Jul 9, 2023

mike-carey commented Jul 27, 2023

mike-carey commented Jul 27, 2023

To summarize:

electriquo commented Aug 10, 2023 • edited Loading

electriquo commented Sep 12, 2023

electriquo commented Oct 12, 2023

Shahard2 commented Oct 12, 2023

kmgrime commented Oct 15, 2023

hwhsu1231 commented Feb 27, 2024

travi commented Apr 19, 2024

dgokcin commented Aug 1, 2022 •

edited

Loading

dgokcin commented Aug 22, 2022 •

edited

Loading

travi commented Sep 19, 2022 •

edited

Loading

dgokcin commented Sep 20, 2022 •

edited

Loading

dgokcin commented Sep 20, 2022 •

edited

Loading

dgokcin commented Sep 26, 2022 •

edited

Loading

mdelapenya commented Oct 10, 2022 •

edited

Loading

hramos05 commented Oct 21, 2022 •

edited

Loading

kmgrime commented Nov 7, 2022 •

edited

Loading

mike-carey commented Jul 6, 2023 •

edited

Loading

electriquo commented Aug 10, 2023 •

edited

Loading