Tag protection rules

[richardlau]

In beta.
Refs: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/configuring-tag-protection-rules

It's might be a good idea to turn this on. We'd need to make sure @nodejs/releasers would be still be able to create the tags for releases.

[targos]

I tried to enable it, but quickly reverted the change, because:

Only users with admin or maintain permissions in the repository will be able to create protected tags, and only users with admin permissions in the repository will be able to delete protected tags.

[richardlau]

https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/configuring-tag-protection-rules claims:

Additionally, you can create custom repository roles to allow other groups of users to create or delete tags that match tag protection rules. For more information, see "Managing custom repository roles for an organization."

[targos]

Unfortunately, I don't think we have access to custom repository roles. At least I can't find the option in the org settings.

[targos]

It seems to be a feature specific to "Enterprise Cloud" GitHub.

[MylesBorins]

I can bring feedback to the team that worked on this

[ljharb]

There also doesn't seem to be a way to block creation of tags that don't match a pattern, but i guess that's consistent with branch protections.

[MylesBorins]

'*' ;)

[JasonEtco]

Hey folks 👋 I worked on this feature, and @MylesBorins was kind enough to share this issue with me. Just wanted to let y'all know that we're looking into applying the same treatment that branch protection has, of specifying a team/user to be able to bypass a tag protection rule.

For context, our initial reasoning for not doing that was to instead rely on custom roles - but we've heard the feedback that OSS projects don't have that capability (as its an Enterprise Cloud feature [I do not know why and it bugs me]), so there's a gap here. I'll drop a note in here if/when that's available. Thanks for sharing your feedback 🙏

[richardlau]

There's now https://github.blog/changelog/2023-04-17-introducing-repository-rules-public-beta/ in public beta.