Repositories

For clone URLs and how git authenticates, see Git access.

Creating and describing one

$ rezee repo create api --public --clone
$ rezee repo view
$ rezee repo update --description "the HTTP API" --homepage https://api.example.com
$ rezee repo topic add go http
$ rezee repo rename api-v2

A repository is private unless you say otherwise. A public one can be cloned by anybody without credentials; everything else about it - who may push, who sees its issues - is unchanged.

--channel names the chat channel a repository is talked about in, which is what lets a push, a pull request or a failed pipeline unfurl somewhere people are already looking.

Collaborators

Workspace membership already grants read across the workspace, and workspace owners and admins already have write. A collaborator is for the cases that do not fit: giving one person write on one repository, or read to somebody who is not a member.

$ rezee member repo list
$ rezee member repo add bob --role write
$ rezee member repo remove bob

Collaborators are the repository owner's to manage, not a workspace admin's - the same line secrets, webhooks and branch protection are drawn along. See Workspaces & roles.

Branch protection

A protection rule is a branch glob and what it forbids. Rules are repository-owner only, and every change is audited - a protection that can be dropped and restored without a trace is not protection.

$ rezee protect add master --require-pr --approvals 1 --checks test,lint
$ rezee protect add "release/*" --require-pr
$ rezee protect list
$ rezee protect remove master

A rule with no flags requires nothing. It is a rule that says the branch exists, which is rarely what somebody means - --require-pr is the usual start.

Overlapping patterns combine, strictest wins. If release/* requires a pull request and release/2.0 requires two approvals, a push to release/2.0 needs both. Required checks are the union of every matching rule's.

Setting a rule is an upsert on its pattern, so the settings form posts the whole rule and saving it twice is the same as saving it once.

When a rule refuses

Direct pushes, deletions and force pushes are refused at the door, by a pre-receive check that runs before anything is reachable. It fails closed: a check that cannot be answered is a no, because policy that fails open is not policy.

A push that touches several branches is one question and one answer - git rejects the whole push when pre-receive says no, so answering per branch would promise something the transport cannot keep.

Approvals and required checks are enforced at the merge instead, since neither is a fact about the push. A pull request's own view says what is blocking it, and rezee pr merge refuses naming the unmet rule.

Releases

A release is the notes beside a tag. The tag is the fact and lives in the repository; the release row holds everything git cannot - a title, a body, who cut it, and whether it is a prerelease.

$ rezee release create v1.4.0 --target master --name "1.4" --notes "$(cat NOTES.md)"
$ rezee release list
$ rezee release view v1.4.0
$ rezee release delete v1.4.0

Cutting one writes the tag first, because a release pointing at a ref that was never created would be a release you cannot check out. Deleting takes the notes and leaves the tag: a tag somebody has already fetched is not ours to retract. The audit log records both halves, so "who named this commit" and "who took the notes down" are both answerable.

A release pipeline holds releases:write and nothing else - deliberately separate from code:write, so the token that publishes a build cannot push to the branch it was built from.

Archiving and deleting

$ rezee repo archive
$ rezee repo unarchive
$ rezee repo delete

An archived repository is readable and takes no writes from anybody, its owner included. That is enforced in the git transport as well as the API, because a read-only repository somebody can still push to is not read-only. Unarchiving puts it back.

Deleting removes the repository and everything hanging off it - runs, artifacts, webhooks, protections, collaborators. Issues that referenced it survive as workspace issues with the link detached.