Azure devops - server-side git hooks

Question

How can we implement server-side hooks, or any similar solution, to restrict git push into git server?

For example, we want to disable push of commits containing *.class files.

Solution 1

I don't think Azure DevOps uses hooks.

You can use Branch Policies to make use of an external validation service (as I understand it this uses web hooks).

Additional: the status of this User Voice request indicates the above is the official answer.

But maybe the simple case would be .gitignore and code reviews?

Solution 2

What I do is using build option together with policies in Azure DevOps. This is my azure-pipelines.yml file:

---
trigger:
  branches:
    exclude:
      - '*'

pool:
  vmImage: 'ubuntu-latest'

steps:
  - script: sudo apt-get install python3-pip
    displayName: 'Install Python PIP'

  - script: sudo apt-get install python3-setuptools
    condition: succeeded()
    displayName: Install Python SetupTools

  - script: sudo pip3 install -r requirements.txt
    condition: succeeded()
    displayName: Install Python PIP Packages

  - task: PythonScript@0
    inputs:
      scriptSource: filePath
      scriptPath: hooks/lint_checker.py
      pythonInterpreter: python3
    condition: succeeded()
    displayName: Lint Checker

Solution 3

Use branch policies and set merge only with PR, after that direct push to the branch will be disabled, you can skip these policies for certain users (build users or admins)

Comments

[Shayki Abramczyk]

Azure DevOps does have services hooks - docs.microsoft.com/en-us/azure/devops/service-hooks/services‌​/… Branch Policies it only to merge between branches, not for each push.

[Yael]

As I understand, branch policies enables applying restrictions to disable direct push without pull requests. But I can't find a way to inspect commits metadata and content.

[Yael]

About service hooks - I understand I can subscribe to push events, but only for notification purpose. Is the push event cancelable?

[Richard]

@Yael Azure DevOps has web hook support for various things, these are push only. Branch policies also allow external validation service which does allow a response.

[Yael]

Hi @Richard, sorry, I really need more guidance. Can you explain how I can use branch policies to restrict push of commits according to their content? Thanks!

[Richard]

@Yael You will need to implement a service to host the logic. This will mean deployment to a point reachable from Azure DevOps. There is nothing inbuilt.

[Thomas]

For anyone also searching for the feedback since Uservoice has been closed: developercommunity.visualstudio.com/idea/365841/… Please vote on this to make MS aware at least...

[Palec]

The branch policies offer really only the policy part. The policy is based on a status pushed by the external service to the PR, using Status API. The external service may be called using a service hook, or it might be called from a pipeline that is configured to run as part of the PR validation, i.e. as yet another branch policy. The latter may enable more granular application of the policy without assistance of the external service itself. docs.microsoft.com/en-us/azure/devops/repos/git/…