Controlling git hub branch creation

[kirannvkumar]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

Misc

Discussion Details

Is it possible to restrict branch creation in github such as release branch to be created only from master branch using github actions ?

[MohitSutharOfficial]

Hi @kirannvkumar!

GitHub Actions alone cannot prevent or restrict branch creation—branch protection and creation policies are managed by GitHub repository settings and not by Actions. However, you can use a combination of GitHub Actions and branch protection rules to enforce workflows after a branch is created.

If you want to ensure that a "release" branch is only created from "master", you can do the following:

• Set up branch protection rules to control who can push to protected branches.
• Use a GitHub Action to monitor branch creation events. If a release branch is created from a source other than master, the Action can alert you or automatically delete the branch.

Here’s an example workflow idea:

1. Use the create event in your workflow to trigger when a branch is created.
2. In the workflow, use the GitHub API to check the source of the new branch.
3. If it wasn't created from master, have the workflow comment, alert, or even delete the branch via API.
4. But remember: Actions can only respond after the branch is created—they can’t fully prevent the creation. For stricter control, consider using server-side hooks (in enterprise environments) or external bots/scripts.

Let me know if you want a sample workflow for this!

[kirannvkumar]

Thanks for the quick response @MohitSutharOfficial. I have been trying various ways but couldn't achieve the exact use case I am looking at. It would be of great help if you could provide me a sample workflow.

[MohitSutharOfficial]

Hi @KiranVKumar!

Happy to help you with a sample workflow. Here are a few workflow examples that will help you control release branch creation:

Simple Release Branch Control
This workflow specifically monitors release branches and ensures they're only created from master:

YAML

    name: Release Branch Control

    on:
         create:

    jobs:
         validate-release-branch:
        if: github.event.ref_type == 'branch' && startsWith(github.event.ref, 'release/')
       runs-on: ubuntu-latest

steps:
  - uses: actions/checkout@v4
    with:
      fetch-depth: 0
      
  - name: Verify release branch source
    run: |
      # Check if the new release branch is based on master
      if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
        echo "❌ Release branch must be created from master branch"
        echo "Deleting unauthorized release branch: ${{ github.event.ref }}"
        
        # Delete the branch
        curl -X DELETE \
          -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
          -H "Accept: application/vnd.github.v3+json" \
          https://api.github.com/repos/${{ github.repository }}/git/refs/heads/${{ github.event.ref }}
          
        exit 1
      else
        echo "✅ Release branch correctly created from master"
      fi

Advanced Branch Creation Monitor
For more comprehensive control with notifications:

   YAML

       name: Branch Creation Control

        on:
            create:

       jobs:
           check-branch-creation:
         runs-on: ubuntu-latest
       if: github.event.ref_type == 'branch'

steps:
  - name: Checkout repository
    uses: actions/checkout@v4
    with:
      fetch-depth: 0
      
  - name: Check if release branch created from master
    run: |
      BRANCH_NAME="${{ github.event.ref }}"
      
      # Check if this is a release branch
      if [[ "$BRANCH_NAME" == release/* ]]; then
        echo "Release branch detected: $BRANCH_NAME"
        
        # Get the commit SHA of the new branch
        BRANCH_SHA=$(git rev-parse "$BRANCH_NAME")
        
        # Check if this commit exists on master
        if git merge-base --is-ancestor "$BRANCH_SHA" origin/master; then
          echo "✅ Release branch $BRANCH_NAME was created from master - ALLOWED"
          exit 0
        else
          echo "❌ Release branch $BRANCH_NAME was NOT created from master - VIOLATION"
          echo "Release branches must be created from master branch only."
          
          # Delete the unauthorized branch
          git push origin --delete "$BRANCH_NAME"
          
          # Create an issue to notify about the violation
          gh issue create \
            --title "Unauthorized Release Branch Creation: $BRANCH_NAME" \
            --body "A release branch \`$BRANCH_NAME\` was created from a source other than master by @${{ github.actor }}. The branch has been automatically deleted. Please create release branches only from the master branch." \
            --label "policy-violation,branch-management"
          
          exit 1
        fi
      else
        echo "Non-release branch detected: $BRANCH_NAME - No restrictions applied"
      fi
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Setup Instructions:

1. Create the workflow file: Save either workflow as .github/workflows/branch-control.yml in your repository

2. Permissions: Make sure your workflow has the necessary permissions. Add this to your workflow if needed:

   YAML
           permissions:
           contents: write
           issues: write
           pull-requests: write.    
   

3. Branch Protection: Additionally, set up branch protection rules on your master branch via Settings → Branches

4. Testing: Test this in a development repository first to ensure it works as expected

How it works:

• Trigger: The workflow runs whenever a new branch is created (on: create)
• Detection: It specifically looks for branches starting with release/
• Validation: Uses git merge-base to check if the branch was created from master
• Enforcement: Automatically deletes unauthorized release branches
• Notification: Creates an issue to alert about policy violations

The key command git merge-base --is-ancestor checks if the branch's commit exists in the master branch history, ensuring it was properly branched from master.

Let me know if you need any modifications to this workflow or have questions about implementation!

[kirannvkumar]

Thanks for the workflow @MohitSutharOfficial, let me try this and get back.

[2006pritam]

Hi @kirannvkumar!

GitHub Actions alone cannot prevent or restrict branch creation—branch protection and creation policies are managed by GitHub repository settings and not by Actions. However, you can use a combination of GitHub Actions and branch protection rules to enforce workflows after a branch is created.

If you want to ensure that a "release" branch is only created from "master", you can do the following:

Set up branch protection rules to control who can push to protected branches.
Use a GitHub Action to monitor branch creation events. If a release branch is created from a source other than master, the Action can alert you or automatically delete the branch.
Here’s an example workflow idea:

Use the create event in your workflow to trigger when a branch is created.
In the workflow, use the GitHub API to check the source of the new branch.
If it wasn't created from master, have the workflow comment, alert, or even delete the branch via API.
But remember: Actions can only respond after the branch is created—they can’t fully prevent the creation. For stricter control, consider using server-side hooks (in enterprise environments) or external bots/scripts.
Let me know if you want a sample workflow for this!

[kirannvkumar]

Thanks for the response @2006pritam, it would be benificial if you could provide me a sample flow, thank you !!

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬