Prevent modifying file on main branch in GitHub

Question

In our main branch we have a file that contains specific configurations. Let's call this file .example-conf.

When the developer creates his branch and pull requests. He can change the content of .example-conf file, so his pull request will execute our custom script based on these configs. Changes in file .example-conf should be ignored on the moment of merge.

We need to prevent developers from modifying .example-conf file in the main branch. But that file should be there for them when they create a branch from main.

We tried implementing a solution with .gitattributes but that doesn't work as there are no conflicts during the merge. So as result after merge content of .example-conf will be modified. We need it to stay same as on main branch.

We use GitHub for version control.

How can this be done?

Answer 1

Github allows you to add an extra layer of security by using code owners. This feature can be enabled by adding the Require pull request reviews before merging branch protection rule and then enable Require review from Code Owners Additionally you have to add a code owners file that specifies who is the code owner of the .example-conf. e.g.

conf/*.conf    [email protected]

For further information see Introducing Code Owners

Answer 2

From what I understand, these are things you want :

1. No one can change .conf in main branch.
2. They can change .conf in branches other than main branch.

You can write a pre-commit hook that aborts the commit if .conf file is changed in main branch. To make a pre-hook, you can write a shell script like :

#!/bin/sh

branch="$(git rev-parse --abbrev-ref HEAD)"

if [ "$branch" = "main" ]; then
  if [ "$(git diff --exit-code .conf)" = "1" ]; then
    echo "Cannot change .conf file in main branch. Aborting commit..."
    echo "Unstage .conf to commit."
    exit 1
  fi
fi

Save this script as pre-commit. Make it executable by using

chmod +x pre-commit

Save/Move this executable in .git/hooks/directory.

This will not allow anyone to change .conf in main branch. However, if you do want to change the .conf in main branch, then you need to pass a --no-verify flag with git commit. This would bypass the hook and will not give error when you change .conf in main and commit it.

Alternative: Branch specific .gitignore

See this answer .You can have a work-around to have branch specific .gitignores. This would mean that a person can change his .conf in local repository feature branch but the changes wont be pushed to remote feature branch. Thus the PR from feature -> main wont have the changes made in .conf.