Branch and tag protection

Protected branches

Protected branches enforce restrictions such as force pushing or merging unless a given number of approvals are obtained on a pull request.

To protect a branch, you need to go to the repository’s Settings > Branches page and add a new rule.

The name of the branch can be a glob where / is the separator and ** spans across separators, for instance main, release/** or precious*.

If two rules apply to the same branch, the one that has no glob takes precedence.

Protected tags

Protected tags allow control over who has permission to create or update Git tags. Each rule allows you to match either an individual tag name, or use an appropriate pattern to control multiple tags at once.

Setting up protected tags

To protect a tag, you need to follow these steps:

1. Go to the repository’s Settings > Tags page.
2. Type a pattern to match a name. You can use a single name, a glob pattern or a regular expression.
3. Choose the allowed users and/or teams. If you leave these fields empty, no one is allowed to create or modify this tag.
4. Select Save to save the configuration.

Protected tag patterns

The pattern uses glob or regular expressions to match a tag name. For regular expressions, you need to enclose the pattern in slashes.

Examples:

Type	Protected tag pattern	Possible matching tags
Glob	v*	v, v-1, version2
Glob	v[0-9]	v0, v1 up to v9
Glob	*-release	2.1-release, final-release
Glob	forgejo	only forgejo
Glob	*forgejo*	forgejo, 2.1-forgejo, 1_forgejo-r
Glob	{v,rel}-*	v-, v-1, v-final, rel-, rel-x
Glob	*	matches all possible tag names
Regex	/\Av/	v, v-1, version2
Regex	/\Av[0-9]\z/	v0, v1 up to v9
Regex	/\Av\d+\.\d+\.\d+\z/	v1.0.17, v2.1.0
Regex	/\Av\d+(\.\d+){0,2}\z/	v1, v2.1, v1.2.34
Regex	/-release\z/	2.1-release, final-release
Regex	/forgejo/	forgejo, 2.1-forgejo, 1_forgejo-r
Regex	/\Aforgejo\z/	only forgejo
Regex	/^forgejo$/	only forgejo
Regex	/\A(v|rel)-/	v-, v-1, v-final, rel-, rel-x
Regex	/.+/	matches all possible tag names