Skip to content

feat: Add file path protection to rulesets #2415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 16 commits into from
Oct 21, 2025
Merged

feat: Add file path protection to rulesets #2415

merged 16 commits into from
Oct 21, 2025

Conversation

@grahamhar
Copy link
Contributor

@grahamhar grahamhar commented Oct 7, 2024 •
edited
Loading

Resolves #2371

Here is the doc that shows the push type rules are restricted.

image

Before the change?

  • Rules could not be added to rulesets to protect pushes to specific files

After the change?

  • rules can now be added to rulesets to prevent pushes to named files

Pull request checklist

  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

  • Yes
  • No

@grahamhar
Copy link
Contributor Author

grahamhar commented Nov 2, 2024 •
edited
Loading

I have tested the changes on an account with paid features so this is now good for review.

@grahamhar
Copy link
Contributor Author

@kfcampbell would it be possible to get feedback on this PR please.

stevehipwell
stevehipwell reviewed Nov 21, 2024
View reviewed changes
website/docs/r/repository_ruleset.html.markdown Outdated

* `tag_name_pattern` - (Optional) (Block List, Max: 1) Parameters to be used for the tag_name_pattern rule. This rule only applies to repositories within an enterprise, it cannot be applied to repositories owned by individuals or regular organizations. Conflicts with `branch_name_pattern` as it only applied to rulesets with target `tag`. (see [below for nested schema](#rules.tag_name_pattern))

* `file_path_restriction` -(Optional) (Block List, Max 1) Parameters to be used for the file_path_restriction rule. When enabled restricts access to files within the repository. (See [Below for nested schema](#rules.file_path_restriction))
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* `file_path_restriction` -(Optional) (Block List, Max 1) Parameters to be used for the file_path_restriction rule. When enabled restricts access to files within the repository. (See [Below for nested schema](#rules.file_path_restriction))
* `file_path_restriction` - (Optional) (Block List, Max 1) Parameters to be used for the file_path_restriction rule. When enabled restricts access to files within the repository. (See [Below for nested schema](#rules.file_path_restriction))

@stevehipwell
Copy link
Collaborator

@grahamhar you might want to rebase as you have conflicts due to the GitHub SDK having been bumped to the next major version.

@grahamhar
Copy link
Contributor Author

@grahamhar you might want to rebase as you have conflicts due to the GitHub SDK having been bumped to the next major version.

Thanks for

@grahamhar you might want to rebase as you have conflicts due to the GitHub SDK having been bumped to the next major version.

Thanks for the review @stevehipwell I think everything is addressed now.

@jimsheldon jimsheldon mentioned this pull request Nov 25, 2024
Open
1 task
@grahamhar
Copy link
Contributor Author

@nickfloyd or @kfcampbell sorry for the direct tag. Is it possible to get a review of this PR?

@unique-dominik
Copy link

Any update here? ❤️ Looking for this 🚀

@bchadwic
Copy link

Also checking in, need this functionality on our team, thank you.

@arun-i-gilead
Copy link

any update in this feature

@kieran-lowe
Copy link

Yeah would be awesome to finally get this.

@arun-i-gilead
Copy link

any updates on this feature ?

@joluizquierdo
Copy link

Any update on this?

@bmurphey-latacora
Copy link

I'm not a maintainer, but FYI I noticed that this line isn't updated with push.

@grahamhar
Copy link
Contributor Author

I'm not a maintainer, but FYI I noticed that this line isn't updated with push.

Thanks for the eyes @bmurphey-latacora updated the missing ref

@kfcampbell kfcampbell moved this from 🏗 In progress to 📆 Monthly in 🧰 Octokit Active Mar 25, 2025
@michalhepner
Copy link

Is there any update on this feature? The Github SDK allows to configure push restrictions since v66 which has been a part of this provider since end of October 2024. It's a vital security feature to prevent users from pushing to sensitive file paths like .github . Are there any plans to push this forward?

@michalhepner michalhepner mentioned this pull request Jun 18, 2025
Closed
1 task
stevehipwell
stevehipwell requested changes Jun 18, 2025
View reviewed changes
website/docs/r/repository_ruleset.html.markdown Outdated
* `file_path_restriction` - (Optional) (Block List, Max 1) Parameters to be used for the file_path_restriction rule. When enabled restricts access to files within the repository. (See [below for nested schema](#rules.file_path_restriction))

* `max_file_size` - (Optional) (Block List, Max 1) Parameters to be used for the max_file_size rule. When enabled restricts the maximum size of a file that can be pushed to the repository. (See [below for nested schema](#rules.max_file_size))

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like the docs are missing for file_extension_restriction here?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just added them. I believe an example is missing as well.

@github-project-automation github-project-automation bot moved this from 📆 Monthly to 🏗 In progress in 🧰 Octokit Active Jun 18, 2025
@Michal1Czarnik
Copy link

Any updates on this?

@nickfloyd nickfloyd moved this to On Deck in Terraform Provider Oct 14, 2025
@nickfloyd nickfloyd moved this from On Deck to In Progress in Terraform Provider Oct 20, 2025
@nickfloyd nickfloyd moved this from In Progress to In Review in Terraform Provider Oct 20, 2025
@nickfloyd nickfloyd added the Type: Feature New feature or request label Oct 20, 2025
nickfloyd
nickfloyd reviewed Oct 20, 2025
View reviewed changes
nickfloyd
nickfloyd reviewed Oct 20, 2025
View reviewed changes
stevehipwell
stevehipwell approved these changes Oct 21, 2025
View reviewed changes
Copy link
Collaborator

@stevehipwell stevehipwell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@nickfloyd nickfloyd merged commit cc3736f into integrations:main Oct 21, 2025
3 checks passed
@github-project-automation github-project-automation bot moved this from 🏗 In progress to ✅ Done in 🧰 Octokit Active Oct 21, 2025
@github-project-automation github-project-automation bot moved this from In Review to Done in Terraform Provider Oct 21, 2025
@grahamhar grahamhar deleted the 2371 branch October 24, 2025 07:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nickfloyd nickfloyd nickfloyd approved these changes

@stevehipwell stevehipwell stevehipwell approved these changes

Assignees

No one assigned

Labels

Type: Feature New feature or request

Projects

Terraform Provider
Status: Done

Milestone

Resolve Terraform integration Issues ...

Development

Successfully merging this pull request may close these issues.

[FEAT]: add file_path_restriction conditionals to repository rulesets