prow/config/branch_protection.go
func (c *Config) GetPolicy(org, repo, branch string, b Branch) (*Policy, error) {
	policy := b.Policy

	// Automatically require contexts from prow which must always be present
	if prowContexts, _, _ := BranchRequirements(org, repo, branch, c.Presubmits); len(prowContexts) > 0 {
		// Error if protection is disabled
		if policy.Protect != nil && !*policy.Protect {
			return nil, fmt.Errorf("required prow jobs require branch protection")
		}
		ps := Policy{
			RequiredStatusChecks: &ContextPolicy{
				Contexts: prowContexts,
			},
		}
		// Require protection by default if ProtectTested is true
		if c.BranchProtection.ProtectTested {
			yes := true
			ps.Protect = &yes
		}
		policy = policy.Apply(ps)
	}

	if policy.Protect != nil && !*policy.Protect {
		// Ensure that protection is false => no protection settings
		var old *bool
		old, policy.Protect = policy.Protect, old
		switch {
		case policy.defined() && c.BranchProtection.AllowDisabledPolicies:
			logrus.Warnf("%s/%s=%s defines a policy but has protect: false", org, repo, branch)
			policy = Policy{
				Protect: policy.Protect,
			}
		case policy.defined():
			return nil, fmt.Errorf("%s/%s=%s defines a policy, which requires protect: true", org, repo, branch)
		}
		policy.Protect = old
	}

	if !policy.defined() {
		return nil, nil
	}
	return &policy, nil
}
func (c *Config) GetPolicy(org, repo, branch string, b Branch) (*Policy, error) {
	policy := b.Policy

	// Automatically require contexts from prow which must always be present
	if prowContexts, _, _ := BranchRequirements(org, repo, branch, c.Presubmits); len(prowContexts) > 0 {
		// Error if protection is disabled
		if policy.Protect != nil && !*policy.Protect {
			return nil, fmt.Errorf("required prow jobs require branch protection")
		}
		ps := Policy{
			RequiredStatusChecks: &ContextPolicy{
				Contexts: prowContexts,
			},
		}
		// Require protection by default if ProtectTested is true
		if c.BranchProtection.ProtectTested {
			yes := true
			ps.Protect = &yes
		}
		policy = policy.Apply(ps)
	}

	if policy.Protect != nil && !*policy.Protect {
		// Ensure that protection is false => no protection settings
		var old *bool
		old, policy.Protect = policy.Protect, old
		switch {
		case policy.defined() && c.BranchProtection.AllowDisabledPolicies:
			logrus.Warnf("%s/%s=%s defines a policy but has protect: false", org, repo, branch)
			policy = Policy{
				Protect: policy.Protect,
			}
		case policy.defined():
			return nil, fmt.Errorf("%s/%s=%s defines a policy, which requires protect: true", org, repo, branch)
		}
		policy.Protect = old
	}

	if !policy.defined() {
		return nil, nil
	}
	return &policy, nil
}
func ( c * Config ) GetPolicy ( org , repo , branch string , b Branch ) ( * Policy , error ) { policy := b . Policy // Automatically require contexts from prow which must always be present if prowContexts , _ , _ := BranchRequirements ( org , repo , branch , c . Presubmits ) ; len ( prowContexts ) > 0 { // Error if protection is disabled if policy . Protect != nil && ! * policy . Protect { return nil , fmt . Errorf ( " " ) } ps := Policy { RequiredStatusChecks : & ContextPolicy { Contexts : prowContexts , } , } // Require protection by default if ProtectTested is true if c . BranchProtection . ProtectTested { yes := true ps . Protect = & yes } policy = policy . Apply ( ps ) } if policy . Protect != nil && ! * policy . Protect { // Ensure that protection is false => no protection settings var old * bool old , policy . Protect = policy . Protect , old switch { case policy . defined ( ) && c . BranchProtection . AllowDisabledPolicies : logrus . Warnf ( " " , org , repo , branch ) policy = Policy { Protect : policy . Protect , } case policy . defined ( ) : return nil , fmt . Errorf ( " " , org , repo , branch ) } policy . Protect = old } if ! policy . defined ( ) { return nil , nil } return & policy , nil }
// GetPolicy returns the protection policy for the branch, after merging in presubmits.
GetPolicy returns the protection policy for the branch after merging in presubmits .