Per branch merge request approvals

Zendesk: https://gitlab.zendesk.com/agent/tickets/19387

Related to https://gitlab.com/gitlab-org/gitlab-ee/issues/179

Customer requests per branch merge request approval settings. This is an add-on to the request for specific branch permissions. Other users have also expressed an interest in this feature in the blog post comments at https://about.gitlab.com/2015/07/29/feature-highlight-merge-request-approvals/

Use case from customer:

Per branch permissions is a great feature and I look forward to it! It does help address some of my problems, but, as you said, not the merge request approvals part. I guess my biggest problem with merge approvals is that it applies to all merge requests for all branches of the project. I really only want to require approvals for our dev branch because that is where we’re having continual problems with broken code being checked in. Our master and patch branches are already locked down to a small handful of people with push/merge permissions so requiring approvals there doesn’t make sense for my teams. On the page I linked below (Drew: blog post linked above) I did see others asking for per-branch approvals, but not sure whether there is wide-spread demand for something like this. I realize that all feature requests can’t be done; some don’t make sense and there isn’t time for others. Hopefully it will be discussed again on your side if it hasn’t been already.

cc/ @JobV Thoughts?

Also requested by: https://na34.salesforce.com/00661000009SaUz

Would love this functionality for us as well. We want approvals on protected branches (our develop/master/release branches) but it's not necessary for branching from and merging to other feature branches.

Added ~238305 label

Milestone changed to %Backlog

We want approvals on protected branches (our develop/master/release branches)

This makes sense.

Mentioned in issue #580

Another request at https://gitlab.zendesk.com/agent/tickets/36938

Mentioned in issue #855

Added ~874214 label

Milestone removed

customer: https://na34.salesforce.com/0016100000W4Jpd

added ~1012342 label

changed milestone to %Backlog

removed ~1012342 label

@smcgivern + @DouweM :

As we build out our merge request functionality, there's a few abstractions to do configuration/customization. Currently, we can configure approvals per project. This makes a lot of sense, since the "project" paradigm is for beginners, and should serve most customers well as they dig into GitLab initially. At some point, we will likely need to implement some type of per-group rules (i.e. all projects within that group have the same config, as per https://gitlab.com/gitlab-org/gitlab-ee/issues/1295). So does it make sense that we should allow config per branch (this issue) or even per merge request (https://gitlab.com/gitlab-org/gitlab-ee/issues/616)? These are definitely valid use cases. I'm thinking we should focus on new functionality first before getting to fine-grained config?

@victorwu this is getting really deep. I agree that the use case is valid, but I agree with your last sentence, and I also think we might want to think about unifying approvals config in general before tackling this.

Could you maybe link this to protected branches so that whoever can merge on a protected branch can approve a merge request? Seems like a simple linkage that might make it easier to understand and enforce from a end-user perspective.

I need this feature too. Following is my scenario.

We have several development teams who can push and approve merge requests to the develop branch. However, we don't want development team to push nor merge into bug fix release branch and to the master branch because the development teams sometimes checks in broken codes.

As such, we have a bug fix team who manages bug fix branch and master branch. We need to restrict those who can accept merge requests on bug fix branch to only those with bug team member roles.

@sidewinder12s I agree that makes sense! The tricky thing is, because this feature is quite 'loose' at the moment, the opposite also makes sense It's quite common to allow people to approve who can't merge (we do this ourselves, for instance).

@hozawa it sounds like you might just be able to use protected branches for this? https://docs.gitlab.com/ee/user/project/protected_branches.html#restricting-push-and-merge-access-to-certain-users

@smcgivern We do need protected branch feature too but protected branch only seems to restrict who can merge into a branch and not restrict who can approve. We want to keep the bug fix branch stable by restricting users who can push and also those who can accept merge requests based on user roles.

We have a procedure that must be executed before a merge request to a bug fix branch is accepted - we want to make sure the person who accepts a merge request is a person who knows and can be trusted to follow that procedure.

@hozawa in that case, this is the correct issue

@smcgivern One question, do protected branches block someone without merge access from accepting an MR? Or does it just block them from performing a merge from the CLI?

@sidewinder12s it only blocks them from accepting an MR, AFAIK. If they merge via the CLI, then they need to push, which is covered by the 'allowed to push' permission.

For example, you could set "Allowed to push" to "No one", and "Allowed to merge" to "Developers + Masters", to require everyone to submit a merge request for changes going into the protected branch.

https://docs.gitlab.com/ee/user/project/protected_branches.html#using-the-allowed-to-merge-and-allowed-to-push-settings

Couldn't the "required approvals" be linked to protected branches? Ideally we require more approvals the closer we get to our production branch; but we'd like to allow "approval-less" MR's too for development branches

removed milestone

We would also like to see this feature. Has there been any movement on it or is it a dead issue?

Another request for this: https://gitlab.zendesk.com/agent/tickets/80829.

@victorwu @smcgivern Is this feature something we can revisit?

changed milestone to %Next 3-6 months

I also have a need for this. Would be great to get. we use a dev branch as the gatekeeper with approvals for merge requests. all stuff in development would go to dev branch. the master branch is where we push stuff as its ready to go to final pre testing and then to production as an official version. Since the code is already reviewed and approved by the time it gets into the dev branch, someone should be able to just merge it right to master when its ready to go as an official release without any kind of approval.

I would use this feature as well.

Would very much appreciate this feature in EE edition. We have test a branch that I would like to add approvals to for our developers group. Code in this branch is peer reviewed and tested by Q/A. Our master branch is locked down so that only members of the Masters group can merge or tag it. Once Q/A signs off on work in the test branch, members of the Masters group should be able to merge the test branch into master without approvals

This would be very nice to have. We work in develop/acceptance/master branches, and while merges from featurebranches and hotfixes need to be approved, merges between develop, acceptance and master don't need the approval.

mentioned in commit 30b55047