-
Notifications
You must be signed in to change notification settings - Fork 60.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
38 changed files
with
383 additions
and
181 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
149 changes: 149 additions & 0 deletions
149
...nforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,149 @@ | ||
| --- | ||
| title: Enforcing code governance in your enterprise with rulesets | ||
| allowTitleToDifferFromFilename: true | ||
| intro: 'You can create a ruleset to target multiple repositories in your enterprise.' | ||
| versions: | ||
| feature: enterprise-code-rulesets | ||
| permissions: 'Enterprise owners' | ||
| shortTitle: Create rulesets | ||
| type: how_to | ||
| topics: | ||
| - Enterprise | ||
| - Policies | ||
| - Repositories | ||
| - Security | ||
| --- | ||
|
|
||
| ## Introduction | ||
|
|
||
| >[!NOTE] Enterprise code rulesets are currently in public preview and subject to change. | ||
| You can create rulesets to control how users can interact with code in repositories across your enterprise. You can: | ||
|
|
||
| * Create a **branch or tag ruleset** to control things like who can push commits to a certain branch, how commits must be formatted, or who can delete or rename a tag. | ||
| * Create a **push ruleset** to block pushes to a private or internal repository and the repository's entire fork network. Push rulesets allow you to block pushes based on file extensions, file path lengths, file and folder paths, and file sizes. | ||
|
|
||
| To learn more, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets). | ||
|
|
||
| ## Importing prebuilt rulesets | ||
|
|
||
| To import a prebuilt ruleset created by {% data variables.product.company_short %}, see [`github/ruleset-recipes`](https://github.com/github/ruleset-recipes). | ||
|
|
||
| {% ifversion repo-rules-management %} | ||
| {% data reusables.repositories.import-a-ruleset-conceptual %} For more information, see "[AUTOTITLE](/organizations/managing-organization-settings/managing-rulesets-for-repositories-in-your-organization#using-ruleset-history)." | ||
| {% endif %} | ||
|
|
||
| ## How will I define where my ruleset applies? | ||
|
|
||
| Rulesets allow you to flexibly target the organizations, repositories, and branches where you want rules to apply. | ||
|
|
||
| * To target **organizations**, you can select all, choose from a list, or define a dynamic pattern for organization names using `fnmatch` syntax. For syntax details, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository#using-fnmatch-syntax). | ||
| * Within those organizations, you can target all **repositories**, or target a dynamic list by custom property. See [AUTOTITLE](/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). | ||
| * Within the repositories, you can target certain **branches or tags**: all branches, the default branch, or a dynamic list using `fnmatch` syntax. | ||
|
|
||
| When you create a ruleset that targets branches in a repository, repository administrators can no longer rename branches or change the default branch in the targeted repository. They can still create and delete branches if they have the appropriate permissions. | ||
|
|
||
| ## How can I control the format of commits? | ||
|
|
||
| In branch or tag rulesets, you can add a rule that restricts the format of commit metadata such as commit message or author email. | ||
|
|
||
| If you select **Must match a given regex pattern restriction**, you can use regular expression syntax to define patterns that the metadata must or must not match. For syntax details and examples, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository#using-regular-expressions-for-commit-metadata). | ||
|
|
||
| ## Using ruleset enforcement statuses | ||
|
|
||
| {% data reusables.repositories.rulesets-about-enforcement-statuses %} | ||
|
|
||
| ## Creating a branch or tag ruleset | ||
|
|
||
| {% data reusables.enterprise-accounts.access-enterprise %} | ||
| {% data reusables.enterprise-accounts.policies-tab %} | ||
| 1. Under "Policies", click **Code**. | ||
| {% data reusables.repositories.create-ruleset-step %} | ||
| {% data reusables.repositories.rulesets-general-step %} | ||
|
|
||
| ### Granting bypass permissions for your branch or tag ruleset | ||
|
|
||
| You can grant certain roles, teams, or apps bypass permissions as well as the ability to approve bypass requests for your ruleset. | ||
|
|
||
| The following are eligible for bypass access: | ||
| * Repository admins, organization owners, and enterprise owners | ||
| * The maintain or write role, or deploy keys. | ||
|
|
||
| 1. To grant bypass permissions for the ruleset, in the "Bypass list" section, click **Add bypass**. | ||
|
|
||
| 1. In the "Add bypass" modal dialog that appears, search for the role, team, or app you would like to grant bypass permissions, then select the role, team, or app from the "Suggestions" section and click Add Selected. | ||
|
|
||
| {% data reusables.repositories.rulesets-branch-tag-bypass-optional-step %} | ||
|
|
||
| ### Choosing which organizations to target in your enterprise | ||
|
|
||
| Select all organizations, choose a selection of existing organizations, or set a dynamic list by name. If you use {% data variables.product.prodname_emus %}, you can also choose to target all repositories owned by users in your enterprise. | ||
|
|
||
| If you set a dynamic list, you'll add one or more naming patterns using `fnmatch` syntax. For example, the string `*open-source` would match any organization with a name that ends with `open-source`. For syntax details, see "[AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository#using-fnmatch-syntax)." | ||
|
|
||
| ### Choosing which repositories to target in your enterprise | ||
|
|
||
| Within the selected organizations, you can target all repositories or target a dynamic list by custom property. See [AUTOTITLE](/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). | ||
|
|
||
| ### Choosing which branches or tags to target | ||
|
|
||
| {% data reusables.repositories.rulesets-target-branches %} | ||
|
|
||
| ### Selecting branch or tag protections | ||
|
|
||
| In the "Branch protections" or "Tag protections" section, select the rules you want to include in the ruleset. When you select a rule, you may be able to enter additional settings for the rule. For more information on the rules, see "[AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets)" | ||
|
|
||
| ### Adding metadata restrictions | ||
|
|
||
| {% data reusables.repositories.rulesets-metadata-step %} | ||
|
|
||
| ### Finalizing your branch or tag ruleset and next steps | ||
|
|
||
| {% data reusables.repositories.rulesets-create-and-insights-step %} | ||
|
|
||
| {% ifversion push-rulesets %} | ||
|
|
||
| ## Creating a push ruleset | ||
|
|
||
| {% data reusables.repositories.push-rules-fork-network-note %} | ||
|
|
||
| You can create a push ruleset for private or internal repositories in your enterprise. | ||
|
|
||
| {% data reusables.enterprise-accounts.access-enterprise %} | ||
| 1. In the left sidebar, in the "Policies" section, click **Code**. | ||
| 1. Click **New ruleset**. | ||
| 1. Click **New push ruleset**. | ||
| 1. Under "Ruleset name," type a name for the ruleset. | ||
| 1. Optionally, to change the default enforcement status, click **Disabled** and select an enforcement status. For more information about enforcement statuses, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets) | ||
|
|
||
| ### Granting bypass permissions for your push ruleset | ||
|
|
||
| >[!NOTE] Bypass permissions for push rulesets that target a repository will be inherited by the entire fork network for this repository. {% data reusables.repositories.rulesets-push-rulesets-bypass-permissions %} | ||
| You can grant certain roles, teams, or apps bypass permissions as well as the ability to approve bypass requests for your ruleset. The following are eligible for bypass access: | ||
|
|
||
| * Repository admins, organization owners, and enterprise owners | ||
| * The maintain or write role, or deploy keys | ||
|
|
||
| 1. To grant bypass permissions for the ruleset, in the "Bypass list" section, click **Add bypass**. | ||
| 1. In the "Add bypass" modal dialog that appears, search for the role, team, or app you would like to grant bypass permissions, then select the role, team, or app from the "Suggestions" section and click Add Selected. | ||
|
|
||
| ### Choosing which organizations to target in your enterprise | ||
|
|
||
| Select all organizations, choose a selection of existing organizations, or set a dynamic list by name. If you use {% data variables.product.prodname_emus %}, you can also choose to target all repositories owned by users in your enterprise. | ||
|
|
||
| If you set a dynamic list, you'll add one or more naming patterns using `fnmatch` syntax. For example, the string `*open-source` would match any organization with a name that ends with `open-source`. For syntax details, see "[AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository#using-fnmatch-syntax)." | ||
|
|
||
| ### Choosing which repositories to target in your enterprise | ||
|
|
||
| Within your chosen organizations, you can target all repositories, or target a dynamic list using custom properties. See [AUTOTITLE](/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). | ||
|
|
||
| ### Selecting push protections | ||
|
|
||
| {% data reusables.repositories.rulesets-push-rules-step %} | ||
|
|
||
| ### Finalizing your push ruleset and next steps | ||
|
|
||
| {% data reusables.repositories.rulesets-create-and-insights-step %} | ||
|
|
||
| {% endif %} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.