On Thu, Jul 23, 2026 at 6:18 PM Jimmy <[email protected]> wrote: > > > Which is not how our development process works. We rely on maintainers > > pushing code directly to branches where it belongs. And we trust > > our maintainers to be careful with that. > > It does seem like too big a request to change your development process. > Yes, the premise of branch protection is moot if the developers still have > the same access.
Thanks Jimmy for your comments. Only the maintainers have the right to create branches and to push the commits. > > The goal would be to prevent a compromised or neglectful individual from > making direct changes to your branches. > So yes, it would require a PR with at least one other approval. > > There's the additional benefit of ensuring status checks (e.g., tests) are > passing before commit. > This also avoids developers introducing competing commits that work fine in > isolation but break each other's commits. When a developer submits a patch to the ovs-dev mailing list, the ovs-robot runs the CI tests and the maintainers ensure that the patch passes all the CI tests before committing. Patchworks for both OVN and OVS can be found here: https://patchwork.ozlabs.org/project/openvswitch/list/? https://patchwork.ozlabs.org/project/ovn/list/? Thanks Numan Numan > > Again, I don't want you to have to rethink your entire SDLC, even if I worry > about a popular tool lacking the controls I'm familiar with. > > Thanks > Jimmy > > On Thu, Jul 23, 2026 at 2:16 PM Ilya Maximets <[email protected]> wrote: >> >> On 7/23/26 10:56 PM, Numan Siddique wrote: >> > On Thu, Jul 23, 2026 at 4:51 PM Ilya Maximets <[email protected]> wrote: >> >> >> >> On 7/23/26 10:08 PM, Numan Siddique wrote: >> >>> On Thu, Jul 23, 2026 at 3:59 PM Ilya Maximets <[email protected]> wrote: >> >>>> >> >>>> On 7/23/26 9:52 PM, Numan Siddique wrote: >> >>>>> Hi OVN and OVS maintainers >> >>>>> >> >>>>> Jimmy (CC'ed) has raised this PR issue for OVN - >> >>>>> https://github.com/ovn-org/ovn/issues/317 >> >>>>> about protecting the release branches. >> >>>>> >> >>>>> Are there any reservations against this request ? Or any downsides ? >> >>>>> >> >>>>> We are setting up pull mirror rules for our downstream OVS and OVN >> >>>>> repos and we want to base it on the protected branches. >> >>>>> >> >>>>> Looks like OVS branches were protected until branch-3.2. >> >>>>> >> >>>>> Can we branch protections for both OVS and OVN ? >> >>>> >> >>>> Branch protection is a mechanism to prevent direct pushes, AFAIR. >> >>>> So, the only way to merge changes becomes a github PR. Which is >> >>>> not how our development process works. We rely on maintainers >> >>>> pushing code directly to branches where it belongs. And we trust >> >>>> our maintainers to be careful with that. >> >>>> >> >>> >> >>> Thanks Ilya for the reply. >> >>> >> >>> I think it is possible to have direct pushes from the maintainers even >> >>> if the branch is protected >> >>> by adding rules to allow maintainers. But it won't be possible for >> >>> the force pushes. >> >>> >> >>> Let me know if it makes sense to protect the branches and also allow >> >>> maintainers >> >>> to push. >> >> >> >> Maintainers are the only ones with the write access, i.e., the only >> >> ones who can push. Is there a point in protection rules if everyone >> >> who can push will still be able to do so? >> >> >> >> We do also allow maintainers to use force-push for quickly fixing >> >> their mistakes. And mistakes are a part of having write access. >> >> Obviously, it's not something that should be used lightly or in any >> >> way frequently. But it's good to have a tool when it is necessary. >> > >> > Got it. I agree there and I myself have done a few mistakes before. >> > >> >> >> >> I'm also not sure what is the original idea behind only mirroring >> >> protected branches? Could you elaborate? >> >> >> > >> > From what I understand, security wants to only mirror the upstream >> > code from the branches which are protected. >> >> Fun fact: I just checked and it is possible to create a branch protection >> rule with the following configuration: >> >> 1. Allow force pushes (for everyone with push access) >> 2. Allow branch deletions (for everyone with push access) >> 3. Require linear history. >> >> This rule adds no real restrictions that are meaningful to our development >> process. The only restriction is a linear history that we use anyway. >> >> But, after applying it to a branch, it now shows a shield icon with the >> 'This branch is protected with branch protections' legend. And since it >> is a legacy branch protection rule, nobody except for the owner can see >> what this protection rule actually is. >> >> Similar thing can be done with the branch 'ruleset', but people can see >> what the ruleset is enforcing byt clicking on it. >> >> Though rulesets allow creation of a fully restrictive rule and make it >> bypassed by everyone with the Write role. Bypasses are not reported in >> the UI, so there will be a rule, but it will never be enforced in practice, >> while being reported as 'Active - This ruleset will be enforced'. >> >> All in all, unless you're the organization owner, the branch protection >> status on the branches page means absolutely nothing. >> >> > >> > Maybe @[email protected] can perhaps elaborate more as he >> > is the one who created the ticket. >> > >> > Thanks >> > Numan >> > >> >>> >> >>> >> >>>> Branch protection is enabled on OVS branches that are no longer >> >>>> maintained to prevent accidental pushes. They are just frozen in >> >>>> time. Same could be done for OVN. >> >>> >> >>> I see. This explains why older branches have protection. >> >>> >> >>> Thanks >> >>> Numan >> >>> >> >>> >> >>> But we can't do that for >> >>>> currently maintained branches. >> >>> >> >>>> >> >>>> Best regards, Ilya Maximets. >> >> >> _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
