{"id":19456117,"url":"https://github.com/yuhattor/branch-protection-bot","last_synced_at":"2026-05-07T05:31:12.021Z","repository":{"id":114388020,"uuid":"567114033","full_name":"yuhattor/branch-protection-bot","owner":"yuhattor","description":"GitHub App to protect default branch after the branch creation","archived":false,"fork":false,"pushed_at":"2022-11-18T09:17:10.000Z","size":3706,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-02-24T16:23:30.916Z","etag":null,"topics":["github","githubapp"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc-by-sa-4.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/yuhattor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-11-17T05:05:47.000Z","updated_at":"2023-09-25T03:07:38.000Z","dependencies_parsed_at":null,"dependency_job_id":"a88d56e7-8fee-42d1-81d3-f892a9c87b53","html_url":"https://github.com/yuhattor/branch-protection-bot","commit_stats":null,"previous_names":["yuhattor/branch-protection-bot"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuhattor%2Fbranch-protection-bot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuhattor%2Fbranch-protection-bot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuhattor%2Fbranch-protection-bot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yuhattor%2Fbranch-protection-bot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/yuhattor","download_url":"https://codeload.github.com/yuhattor/branch-protection-bot/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240654150,"owners_count":19835854,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["github","githubapp"],"created_at":"2024-11-10T17:16:08.682Z","updated_at":"2026-05-07T05:31:06.986Z","avatar_url":"https://github.com/yuhattor.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# BranchProtectionBot - GitHub App\n\n[![Test and Deploy BranchProtectionBot to Azure Function App](https://github.com/yuhattor/BranchProtectionBot/actions/workflows/main.yml/badge.svg)](https://github.com/yuhattor/BranchProtectionBot/actions/workflows/main.yml)\n\n\u003cimg src=\"./contents/bot.png\" width=\"150px\"\u003e\n\n**BranchProtectionBot** is a GitHub App that enables you to protect your default branch.\n\nTo prevent commits from being lost due to accidental force pushes, you should protect your branch. However, it's very hard to apply protection rules every single time right after your organization member creates a repository. This bot automates the process to apply the rule and inform you about the protection rules applied to the repository.\n\nBranchProtectionBot is easy to deploy. Please visit **[HERE](https://github.com/apps/BranchProtectionBot)** to install the bot in your organization.\n\n## How to use\n\nThere are three steps to protect your branch and manage your protection rules\n\n1. Installing the bot.\n2. A new branch created in the organization will be protected.\n3. You can edit the default rule settings for branch protection.\n\n![](./contents/installation.png)\n\n## Architecture and process\n\n### Process to protect master/main branch\n\n![](./contents/protection-diagram.png)\n\n1. When your organization member creates a new repository in the organization, BranchProtectionBot streams the repository's \"created\" event.\n2. Azure Functions trigger BranchProtectionBot API. (```POST: /api/ProtectMaster```)\n3. BranchProtectionBot API initiates the repository with README.md. The default branch is also created at the same time.\n4. BranchProtectionBot API protects the default branch. BranchProtectionBot supports both master and main as the default branch.\n5. BranchProtectionBot API creates an issue in the repository. It also mentions a specific user.\n\n### Process to register application\n\n![](./contents/registration-diagram.png)\n\n1. When the bot is installed, registration callback api on Azure Functions is called. (```GET: /api/ReceiveInstallation```)\n2. The api registers organization and installation ID. After registration, the api provide a password to manage the servie setting.\n3. User can edit BranchProtectionBot setting by accessing the edit page.(```GET: /api/EditRule```)\n4. The API updates the CosmosDB.(```POST: /api/UpdateRule```)\n\n## Bring Your Own App\n\nYou can host BranchProtectionBot by yourself. If you want to deploy the app, you will need an Azure environment. The app is hosted on Azure Functions and connect to Azure CosmosDB. Deployment can be easily done by Azure Bicep (Infrastructure as Code) and GitHub Actions.\n\n### Prerequisites\n\n- Your GitHub Apps\n- Azure (Azure Functions and Azure CosmosDB)\n\n### Step 1: Provision the infrastructure and Deploy apps on Azure\n\n1. Fork and clone this repository\n\n2. Deploy Azure Resources with Infrastructure as Code templates. Run the script as follow\n\n   ```bash\n   # Define your resource group name and the region to deploy\n   ResourceGroupName=ProtectionBotRG\n   ResourceRegion=japaneast\n   \n   # Deploy Azure resources with Azure Bicep, IaC service\n   az login\n   az group create --name $ResourceGroupName --location $ResourceRegion\n   az deployment group create --resource-group $ResourceGroupName --template-file main.bicep --parameters appInsightsLocation=$ResourceRegion\n   ```\n\n   NOTE: You will get the param, `postInstallationUrl` and `webhookUrl` after the successfull deployment. Please note the params. These params will be used for setting up GitHub App.\n\n3. Setup GitHub Actions for the app deployment\n   Get the secrets that you will use for GitHub Actions pipeline beforehand\n\n   ```bash\n   # Get the Service Principal Info\n   az ad sp create-for-rbac --name \"BranchProtectionBot\" --role contributor --scopes /subscriptions/\u003cYOUR SUBSCRIPTION ID\u003e --sdk-auth\n   ```\n\n   Set the params in the GitHub Actions secrets\n\n   Input |Parameters\n   -----|-----\n   AZURE_CREDENTIALS | json string you get from running `az ad sp  create-for-rbac` command\n   AZURE_FUNCTIONAPP_NAME | What you get from the IaC deployment output (example: botapp-ph7bvwxlx7l3g)\n\n4. Run GitHub Actions\n\n### Step 2: Create and configure GitHub App\n\nAfter you have done the configuration, next you need to setup the GitHub App\n\n1. On GitHub, go to `Settings` \u003e `Developer settings` \u003e [`GitHub Apps`](https://github.com/settings/apps)\n\n2. Then click `New GitHub App` button\n\n3. Register new GitHub App\n\n   Input|Value\n   ---|---\n   Post installation | https://\\\u003cYour function app name\\\u003e.azurewebsites.net/api/ReceiveInstallation ![](./contents/hands-on/post-installation-setting.png)\n   Webhook URL| https://\\\u003cYour function app name\\\u003e.azurewebsites.net/api/ProtectMaster ![](./contents/hands-on/webhook-seetting.png)\n   Webhook | active\n\n4. Set the `Repository Permissions`\n   Only the important settings are listed here.\n\n   1. General Settings\n\n      Permissions|Value|Detail\n      ---|---|---\n      Administration | Read \u0026 Write | This permission is necessary to apply branch protection rule\n      Contents | Read \u0026 Write | This permission is necessary to initiate repository with README.md\n      Issues | Read \u0026 Write | This permission is necessary to create an issue\n\n   2. Events subscription settings\n      Subscribe to events|Check\n      ---|---\n      Repository| true\n\n   3. Confirm Creation\n\n5. After the creation\n   Please memo your App ID. This will be used for API's App Configuration.\n   ![](.//contents/hands-on/app-id.png)\n\n6. Generate and Download GitHub Apps' PEM key\n   You will need PEM as well for API's App Configuration.\n   ![](./contents/hands-on/private-keys.png)\n\n   Please refer to [the documentation](https://developer.github.com/apps/building-github-apps/authenticating-with-github-apps/) to get PEM file and App ID. And to learn more about GitHub Apps, please check [this documentation](https://docs.github.com/ja/github-ae@latest/developers/apps/about-apps)\n\n7. Configure your Azure Function's apps config.\n   You are almost there! Finally, you need to run the GitHub App PEM and App ID for function app\n\n   ```\n\n   # Set your GitHub App ID to a variable\n   app_id=\u003cYOUR_APP_ID\u003e\n\n   # Set your GitHub App PEM to a variable\n   pem_path=\u003cYOUR PATH TO THE\u003e/branchprotectionbot.private-key.pem\n   pem_str=$(awk 'NF {sub(/\\r/, \"\"); printf \"%s\\\\n\",$0;}' $pem_path)\n   echo $pem_str\n\n   # Configure API's setting\n   az webapp config appsettings set -g $ResourceGroupName -n \u003cYOUR_APP_NAME\u003e --settings gh_app_pem=$pem_str gh_app_id=$app_id\n   ```\n\n   Please refer to [the link](https://docs.microsoft.com/en-us/azure/azure-functions/functions-how-to-use-azure-function-app-settings) for Azure Functions configuration\n\n8. Your branch will be protected!\n   ![](./contents/hands-on/result.png)\n\n## Licensing\n\nThe GitHub App is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Please see LICENSE.txt in this repository for the full text of the license.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyuhattor%2Fbranch-protection-bot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyuhattor%2Fbranch-protection-bot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyuhattor%2Fbranch-protection-bot/lists"}