Protected branch on `master` causes direct pushes to master to fail on CE and EE

I was trying to do a release for 10.0.1, but I was startled to see a push to GitLab.com failed:

[2017-09-23 20:46:30 -0400] --> git push gitlab master:master
Counting objects: 6, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (6/6), done.
Writing objects: 100% (6/6), 782 bytes | 0 bytes/s, done.
Total 6 (delta 4), reused 0 (delta 0)
remote: GitLab: You are not allowed to push code to protected branches on this project.
To gitlab.com:gitlab-org/gitlab-ee.git
 ! [remote rejected]       master -> master (pre-receive hook declined)

It looks like only @rspeicher and @jarka have permission to direct pushes here. If we change release managers every month, it's very likely that this would fail.

This caused me confusion, and I aborted the tag until I realized it was a fairly innocent thing.

changed the description

Yeah, we removed everyone from the "allowed to push" list on Sep 6th, see https://gitlab.slack.com/archives/C02PF508L/p1504686364000101, which is why it only now started being a problem.

I added myself because I knew it would come up as part of the release process, and only added Jarka at the last minute on the 21st when it was obvious she'd be doing the 10.0 final release.

The changelog compilation pushes the changes to master, and that's performed as the user who does the release.

We'd either need to make release-tools open MRs for the master changes, or update our release process so that the process is performed a by a bot user via CI, which I know was something we discussed a while back in order to limit the amount of access we had to give additional people each month as we changed RMs.

I'd prefer the latter if we can, but I don't remember what blocked us originally.

Third option from the Slack thread that I forgot I even wrote:

In the meantime I'm wondering if our API is good enough to automate the unprotect and re-protect around performing the release

I think due to the 9.5.6 release this caused dev to go out of sync with GitLab.com in https://gitlab.com/gitlab-org/gitlab-ee/issues/3614. Can we address this before 10.1?

Looked into it quickly.

The gitlab API gem we're using doesn't currently support the developers_can_push or developers_can_merge params that our API does.

Further, it doesn't appear that our own API allows you to set specific roles/groups/people on those protected branches anyway.

So basically all we can do with the API now is remove the master branch protection, then re-add it, which will give it the default level of "Masters can push", which kind of puts us back where we were.

Further, it doesn't appear that our own API allows you to set specific roles/groups/people on those protected branches anyway.

Sounds like we should add support for this?