Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-07 10:52:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add block on pending codeowner reviews branch protection (#34995)

Browse Source 
This commit introduces a new branch protection rule that allows merge
blocking if there are pending reviews from one or more code owners (as
defined in any valid `CODEOWNERS` file). This is determined by
evaluating each rule present in the `CODEOWNERS` file individually. For
every rule, at least one named code owner (or member of a code owner
team) must have given an approving review for merging to be possible.

Closes #32602 

---

This PR does NOT display code owners separately from other reviewers
(#28137)

### Screenshot

<details>
<summary>Pull Request</summary>
<img
src="https://github.com/user-attachments/assets/74560f9c-9f59-477a-b270-63f937b26d6a"
/>
</details>

<details>
<summary>Branch Protection Rule</summary>
<img
src="https://github.com/user-attachments/assets/f0a9ce00-38fe-4eed-b6a3-5290aa404610"
/>
</details>

Doc PR
https://gitea.com/gitea/docs/pulls/245

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Dominique Hummel
2026-07-31 15:00:59 +02:00
committed by GitHub
parent 805697089e
commit 1f6cfe611a
17 changed files with 408 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/pull_review_test.go
+120 -3
View File
@@ -13,6 +13,7 @@ import (
"time"
"gitea.dev/models/db"
git_model "gitea.dev/models/git"
issues_model "gitea.dev/models/issues"
repo_model "gitea.dev/models/repo"
"gitea.dev/models/unittest"
@@ -20,6 +21,7 @@ import (
"gitea.dev/modules/git"
"gitea.dev/modules/test"
issue_service "gitea.dev/services/issue"
pull_service "gitea.dev/services/pull"
repo_service "gitea.dev/services/repository"
files_service "gitea.dev/services/repository/files"
"gitea.dev/tests"
@@ -51,6 +53,8 @@ func TestPullView_ReviewerMissed(t *testing.T) {
func TestPullView_CodeOwner(t *testing.T) {
onGiteaRun(t, func(t *testing.T, u *url.URL) {
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
user5 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
user8 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 8})
// Create the repo.
repo, err := repo_service.CreateRepositoryDirectly(t.Context(), user2, user2, repo_service.CreateRepoOptions{
@@ -62,6 +66,17 @@ func TestPullView_CodeOwner(t *testing.T) {
}, true)
assert.NoError(t, err)
// create code owner branch protection
protectBranch := git_model.ProtectedBranch{
BlockOnCodeownerReviews: true,
RepoID: repo.ID,
RuleName: "master",
CanPush: true,
}
err = pull_service.CreateOrUpdateProtectedBranch(t.Context(), repo, &protectBranch, git_model.WhitelistOptions{})
assert.NoError(t, err)
// add CODEOWNERS to default branch
_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
OldBranch: repo.DefaultBranch,
@@ -106,7 +121,7 @@ func TestPullView_CodeOwner(t *testing.T) {
require.NoError(t, err)
// update the file on the pr branch
_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
resp, err := files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
OldBranch: "codeowner-basebranch",
Files: []*files_service.ChangeRepoFile{
{
@@ -142,6 +157,73 @@ func TestPullView_CodeOwner(t *testing.T) {
prUpdated2 := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: pr.ID})
assert.NoError(t, prUpdated2.LoadIssue(t.Context()))
assert.Equal(t, "Test Pull Request2", prUpdated2.Issue.Title)
// ensure it cannot be merged
hasCodeownerReviews := issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.False(t, hasCodeownerReviews)
_, _, err = issues_model.SubmitReview(t.Context(), user5, pr.Issue, issues_model.ReviewTypeApprove, "Very good", resp.Commit.SHA, false, make([]string, 0))
assert.NoError(t, err)
// should still fail (we also need user8)
hasCodeownerReviews = issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.False(t, hasCodeownerReviews)
_, _, err = issues_model.SubmitReview(t.Context(), user8, pr.Issue, issues_model.ReviewTypeApprove, "Very good", resp.Commit.SHA, false, make([]string, 0))
assert.NoError(t, err)
// now we should be able to merge
hasCodeownerReviews = issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.True(t, hasCodeownerReviews)
// a later requested-changes review from a required code owner must override
// that user's earlier approval and no longer satisfy the requirement
_, _, err = issues_model.SubmitReview(t.Context(), user5, pr.Issue, issues_model.ReviewTypeReject, "Needs changes", resp.Commit.SHA, false, make([]string, 0))
assert.NoError(t, err)
hasCodeownerReviews = issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.False(t, hasCodeownerReviews)
})
t.Run("Dismissed Code Owner Review", func(t *testing.T) {
_, err := files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
NewBranch: "codeowner-dismiss-branch",
Files: []*files_service.ChangeRepoFile{
{
Operation: "update",
TreePath: "README.md",
ContentReader: strings.NewReader("# New README content\n"),
},
},
})
assert.NoError(t, err)
session := loginUser(t, "user2")
testPullCreate(t, session, "user2", "test_codeowner", false, repo.DefaultBranch, "codeowner-dismiss-branch", "Test Code Owner Dismissal")
pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{BaseRepoID: repo.ID, HeadBranch: "codeowner-dismiss-branch"})
unittest.AssertExistsAndLoadBean(t, &issues_model.Review{IssueID: pr.IssueID, Type: issues_model.ReviewTypeRequest, ReviewerID: 5})
hasCodeownerReviews := issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.False(t, hasCodeownerReviews)
_, _, err = issues_model.SubmitReview(t.Context(), user5, pr.Issue, issues_model.ReviewTypeApprove, " LGTM", "", false, make([]string, 0))
assert.NoError(t, err)
hasCodeownerReviews = issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.True(t, hasCodeownerReviews)
review := unittest.AssertExistsAndLoadBean(t, &issues_model.Review{IssueID: pr.IssueID, ReviewerID: 5, Type: issues_model.ReviewTypeApprove})
assert.False(t, review.Dismissed)
err = issues_model.DismissReview(t.Context(), review, true)
assert.NoError(t, err)
review, err = issues_model.GetReviewByID(t.Context(), review.ID)
assert.NoError(t, err)
assert.True(t, review.Dismissed)
hasCodeownerReviews = issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.False(t, hasCodeownerReviews)
})
// change the default branch CODEOWNERS file to change README.md's codeowner
@@ -158,7 +240,7 @@ func TestPullView_CodeOwner(t *testing.T) {
t.Run("Second Pull Request", func(t *testing.T) {
// create a new branch to prepare for pull request
_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
resp, err := files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
NewBranch: "codeowner-basebranch2",
Files: []*files_service.ChangeRepoFile{
{
@@ -176,6 +258,24 @@ func TestPullView_CodeOwner(t *testing.T) {
pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{BaseRepoID: repo.ID, HeadBranch: "codeowner-basebranch2"})
unittest.AssertExistsAndLoadBean(t, &issues_model.Review{IssueID: pr.IssueID, Type: issues_model.ReviewTypeRequest, ReviewerID: 8})
// should need user8 approval only now
hasCodeownerReviews := issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.False(t, hasCodeownerReviews)
// exercise the real merge-time gate, not just the helper: the persisted
// protection rule must block the merge on the missing code owner review
err = pull_service.CheckPullBranchProtections(t.Context(), pr, false)
assert.ErrorContains(t, err, "code owner")
_, _, err = issues_model.SubmitReview(t.Context(), user8, pr.Issue, issues_model.ReviewTypeApprove, "Very good", resp.Commit.SHA, false, make([]string, 0))
assert.NoError(t, err)
hasCodeownerReviews = issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.True(t, hasCodeownerReviews)
// and once the code owner has approved, the merge gate no longer blocks
assert.NoError(t, pull_service.CheckPullBranchProtections(t.Context(), pr, false))
})
t.Run("Forked Repo Pull Request", func(t *testing.T) {
@@ -187,7 +287,7 @@ func TestPullView_CodeOwner(t *testing.T) {
assert.NoError(t, err)
// create a new branch to prepare for pull request
_, err = files_service.ChangeRepoFiles(t.Context(), forkedRepo, user5, &files_service.ChangeRepoFilesOptions{
resp, err := files_service.ChangeRepoFiles(t.Context(), forkedRepo, user5, &files_service.ChangeRepoFilesOptions{
NewBranch: "codeowner-basebranch-forked",
Files: []*files_service.ChangeRepoFile{
{
@@ -228,6 +328,23 @@ func TestPullView_CodeOwner(t *testing.T) {
pr = unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{BaseRepoID: repo.ID, HeadRepoID: forkedRepo.ID, HeadBranch: "codeowner-basebranch-forked"})
unittest.AssertExistsAndLoadBean(t, &issues_model.Review{IssueID: pr.IssueID, Type: issues_model.ReviewTypeRequest, ReviewerID: 8})
// will also need user8 for this
hasCodeownerReviews := issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.False(t, hasCodeownerReviews)
_, _, err = issues_model.SubmitReview(t.Context(), user5, pr.Issue, issues_model.ReviewTypeApprove, "Very good", resp.Commit.SHA, false, make([]string, 0))
assert.NoError(t, err)
// should still fail (user5 is not a code owner for this PR)
hasCodeownerReviews = issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.False(t, hasCodeownerReviews)
_, _, err = issues_model.SubmitReview(t.Context(), user8, pr.Issue, issues_model.ReviewTypeApprove, "Very good", resp.Commit.SHA, false, make([]string, 0))
assert.NoError(t, err)
hasCodeownerReviews = issue_service.HasAllRequiredCodeownerReviews(t.Context(), &protectBranch, pr)
assert.True(t, hasCodeownerReviews)
})
})
}