gitlab.projects.create from template creates project with unprotected main branch #3038

raedma · 2024-11-14T15:37:10Z

raedma
Nov 14, 2024

Description of the problem, including code/CLI snippet

I am trying to create projects in subgroups by a python script using python-gitlab. The projects are created from a template. The template project has a single branch main that is the default and protected:

And Settings -> * Repository* - > Protected branches looks like this:

The creation of the project is done by

project = gitlab.projects.create({
	'name': projectname,
	'description' : projectdescription,
	'namespace_id': subgroup.id,
	'use_custom_template': True,
	'group_with_project_templates_id': group_with_project_templates_id,
	'template_project_id': template_project_id,
            ... some more preferences
})

As a result I get a new project. The result of a print(project) gives

<class 'gitlab.v4.objects.projects.Project'> => {'id': 44638, 'description': None, 'name': '[NAME]', 'name_with_namespace': '[VALUE]', 'path': '[VALUE]', 'path_with_namespace': '[VALUE]', 'created_at': '2024-11-14T15:09:25.753Z', 'default_branch': 'main', 'tag_list': [], 'topics': [], 'ssh_url_to_repo': 'git@[VALUE].git', 'http_url_to_repo': '[VALUE].git', 'web_url': '[URL]', 'readme_url': None, 'forks_count': 0, 'avatar_url': None, 'star_count': 0, 'last_activity_at': '2024-11-14T15:09:25.717Z', 'namespace': {'id': 63056, 'name': '[VALUE]', 'path': '[VALUE]', 'kind': 'group', 'full_path': '[VALUE]', 'parent_id': 62984, 'avatar_url': None, 'web_url': '[VALUE]'}, '_links': {'self': 'https://gitlab.dlr.de/api/v4/projects/44638', 'issues': 'https://gitlab.dlr.de/api/v4/projects/44638/issues', 'merge_requests': 'https://gitlab.dlr.de/api/v4/projects/44638/merge_requests', 'repo_branches': 'https://gitlab.dlr.de/api/v4/projects/44638/repository/branches', 'labels': 'https://gitlab.dlr.de/api/v4/projects/44638/labels', 'events': 'https://gitlab.dlr.de/api/v4/projects/44638/events', 'members': 'https://gitlab.dlr.de/api/v4/projects/44638/members', 'cluster_agents': 'https://gitlab.dlr.de/api/v4/projects/44638/cluster_agents'}, 'packages_enabled': True, 'empty_repo': True, 'archived': False, 'visibility': 'private', 'resolve_outdated_diff_discussions': False, 'container_expiration_policy': {'cadence': '1d', 'enabled': False, 'keep_n': 10, 'older_than': '90d', 'name_regex': '.*', 'name_regex_keep': None, 'next_run_at': '2024-11-15T15:09:25.765Z'}, 'repository_object_format': 'sha1', 'issues_enabled': False, 'merge_requests_enabled': True, 'wiki_enabled': False, 'jobs_enabled': False, 'snippets_enabled': False, 'container_registry_enabled': False, 'service_desk_enabled': False, 'can_create_merge_request_in': True, 'issues_access_level': 'disabled', 'repository_access_level': 'enabled', 'merge_requests_access_level': 'enabled', 'forking_access_level': 'enabled', 'wiki_access_level': 'disabled', 'builds_access_level': 'disabled', 'snippets_access_level': 'disabled', 'pages_access_level': 'disabled', 'analytics_access_level': 'enabled', 'container_registry_access_level': 'disabled', 'security_and_compliance_access_level': 'private', 'releases_access_level': 'enabled', 'environments_access_level': 'enabled', 'feature_flags_access_level': 'enabled', 'infrastructure_access_level': 'enabled', 'monitor_access_level': 'enabled', 'model_experiments_access_level': 'enabled', 'model_registry_access_level': 'enabled', 'emails_disabled': False, 'emails_enabled': True, 'shared_runners_enabled': True, 'lfs_enabled': True, 'creator_id': 13620, 'import_url': None, 'import_type': 'gitlab_custom_project_template', 'import_status': 'scheduled', 'import_error': None, 'description_html': '', 'updated_at': '2024-11-14T15:05:14.750Z', 'ci_default_git_depth': 20, 'ci_forward_deployment_enabled': True, 'ci_forward_deployment_rollback_allowed': True, 'ci_job_token_scope_enabled': False, 'ci_separated_caches': True, 'ci_allow_fork_pipelines_to_run_in_parent_project': True, 'ci_id_token_sub_claim_components': ['project_path', 'ref_type', 'ref'], 'build_git_strategy': 'fetch', 'keep_latest_artifact': True, 'restrict_user_defined_variables': False, 'ci_pipeline_variables_minimum_override_role': 'maintainer', 'runners_token': None, 'runner_token_expiration_interval': None, 'group_runners_enabled': True, 'auto_cancel_pending_pipelines': 'enabled', 'build_timeout': 3600, 'auto_devops_enabled': False, 'auto_devops_deploy_strategy': 'continuous', 'ci_push_repository_for_job_token_allowed': False, 'ci_config_path': None, 'public_jobs': True, 'shared_with_groups': [], 'only_allow_merge_if_pipeline_succeeds': False, 'allow_merge_on_skipped_pipeline': None, 'request_access_enabled': True, 'only_allow_merge_if_all_discussions_are_resolved': False, 'remove_source_branch_after_merge': True, 'printing_merge_request_link_enabled': True, 'merge_method': 'merge', 'squash_option': 'default_off', 'enforce_auth_checks_on_uploads': True, 'suggestion_commit_message': None, 'merge_commit_template': None, 'squash_commit_template': None, 'issue_branch_template': None, 'warn_about_potentially_unwanted_characters': True, 'autoclose_referenced_issues': True, 'approvals_before_merge': 0, 'mirror': False, 'external_authorization_classification_label': None, 'marked_for_deletion_at': None, 'marked_for_deletion_on': None, 'requirements_enabled': False, 'requirements_access_level': 'enabled', 'security_and_compliance_enabled': True, 'pre_receive_secret_detection_enabled': False, 'compliance_frameworks': [], 'merge_requests_template': None, 'ci_restrict_pipeline_cancellation_role': 'developer', 'merge_pipelines_enabled': False, 'merge_trains_enabled': False, 'merge_trains_skip_train_allowed': False, 'allow_pipeline_trigger_approve_deployment': False}

However, the main branch of the project is not protected all of a sudden. If I call

print(project.branches.get(project.default_branch))

I get

<class 'gitlab.v4.objects.branches.ProjectBranch'> => {'name': 'main', 'commit': {'id': 'c9c61bb46e2040b904ab9cc5c6f14e969b551503', 'short_id': 'c9c61bb4', 'created_at': '2024-11-13T15:24:00.000+00:00', 'parent_ids': ['d3f2686c9750ec7c49a7f1467dd0f6bf734ba378'], 'title': 'Update README.md', 'message': 'Update README.md', 'author_name': '[MYNAME]', 'author_email': '[MYMAIL]', 'authored_date': '2024-11-13T15:24:00.000+00:00', 'committer_name': '[MYNAME]', 'committer_email': '[MYMAIL]', 'committed_date': '2024-11-13T15:24:00.000+00:00', 'trailers': {}, 'extended_trailers': {}, 'web_url': '[COMMITID]'}, 'merged': False, 'protected': False, 'developers_can_push': False, 'developers_can_merge': False, 'can_push': True, 'default': True, 'web_url': '[URL]/-/tree/main'}

with my main problem being: 'protected': False

Expected Behavior

I would expect the main branch of the newly created project to be protected.

Actual Behavior

The main branch of the newly created project is not protected. A quick look in the newly created project Settings -> * Repository* - > Protected branches confirms that there are no protected branches:

Specifications

python-gitlab version: 5.0.0-pyhff2d567_0
Gitlab server version (or gitlab.com): GitLab Enterprise Edition v17.3.6-ee

Is this the desired behavior? If so, how can I protect the main branch after project creation? I can add them manually in Settings -> * Repository* - > Protected branches but I would like to do that via the script. Unfortunately, I can't seem to figure out out to protect a branch after it was created from the python-gitlab api.

Answered by raedma

Nov 14, 2024

As I have never used a template before, are you sure that using a template means it will create a protected branch?

Well, from my understanding the created project should be a quasi-copy of the template source. Also, I would expect any newly created project to have a protected main branch.

As a workaround you can protect the branch after creating the project: https://python-gitlab.readthedocs.io/en/stable/gl_objects/protected_branches.html#examples

Thanks, I saw that already. Re-tried it and now I can protected the main branch after project creation with

mainbranch = project.protectedbranches.create({
			'name': project.default_branch,
			'merge_access_level': gitlab.const.AccessLevel…

View full answer

JohnVillalovos · 2024-11-14T16:00:52Z

JohnVillalovos
Nov 14, 2024
Maintainer

My first thought is that it is an upstream GitLab issue.

python-gitlab just sends the request to GitLab.

Upstream API document: https://docs.gitlab.com/ee/api/projects.html#create-a-project

As I have never used a template before, are you sure that using a template means it will create a protected branch?

As a workaround you can protect the branch after creating the project: https://python-gitlab.readthedocs.io/en/stable/gl_objects/protected_branches.html#examples

0 replies

raedma · 2024-11-14T16:16:35Z

raedma
Nov 14, 2024
Author

As I have never used a template before, are you sure that using a template means it will create a protected branch?

Well, from my understanding the created project should be a quasi-copy of the template source. Also, I would expect any newly created project to have a protected main branch.

As a workaround you can protect the branch after creating the project: https://python-gitlab.readthedocs.io/en/stable/gl_objects/protected_branches.html#examples

Thanks, I saw that already. Re-tried it and now I can protected the main branch after project creation with

mainbranch = project.protectedbranches.create({
			'name': project.default_branch,
			'merge_access_level': gitlab.const.AccessLevel.DEVELOPER,
			'push_access_level': gitlab.const.AccessLevel.MAINTAINER,
		})

3 replies

JohnVillalovos Nov 14, 2024
Maintainer

@raedma I went ahead and converted this to a discussion.

As far as automatically creating a protected branch on project creation. I don't see any mention of protected branches in the upstream documentation ( https://docs.gitlab.com/ee/api/projects.html#create-a-project ) when using the "create project" API. It appears that GitLab requires it to be a two-step process.

raedma Nov 14, 2024
Author

Thx for the remark. I was just under the impression that it would be logical that the default branch is protected to limit the chances of something unwanted happing. Also, this is the default behavior in case you create a project (plain or from template) via the GitLab instance homepage.

nejch Nov 15, 2024
Maintainer

I believe this has something to do with deveopers being able to create projects and then not being able push to them (https://gitlab.com/gitlab-org/gitlab/-/issues/31602). So this might be expected behavior.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gitlab.projects.create from template creates project with unprotected main branch #3038

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 3 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

gitlab.projects.create from template creates project with unprotected main branch #3038

raedma Nov 14, 2024

Description of the problem, including code/CLI snippet

Expected Behavior

Actual Behavior

Specifications

Replies: 2 comments · 3 replies

JohnVillalovos Nov 14, 2024 Maintainer

raedma Nov 14, 2024 Author

JohnVillalovos Nov 14, 2024 Maintainer

raedma Nov 14, 2024 Author

nejch Nov 15, 2024 Maintainer

raedma
Nov 14, 2024

Replies: 2 comments 3 replies

JohnVillalovos
Nov 14, 2024
Maintainer

raedma
Nov 14, 2024
Author

JohnVillalovos Nov 14, 2024
Maintainer

raedma Nov 14, 2024
Author

nejch Nov 15, 2024
Maintainer