basic access control

repo    gitolite-admin
        RW+                 =   sitaram
        # this is equivalent to:
        RW+     refs/.*     =   sitaram

Sitaram is the only admin. He can push, create, delete, or rewind any branch or tag in the gitolite-admin repo.

repo    testing
        RW+     =   @all

The 'testing' repo is a play area for everyone. Anyone can do anything to any branch or tag on it.

repo    foo
        RW+     =   sitaram dilbert
        RW      =   alice ashok
        R       =   wally

Wally can only read the repo. Alice and Ashok can push but not rewind; only Sitaram and Dilbert can do that.

And now, a common misunderstanding:

        R master    =   wally       # WILL NOT DO WHAT YOU THINK IT DOES!!

This won't work. Please see here for more on this.

repo    foo
        RW      master$             =   dilbert alice
        # this is equivalent to:
        RW      refs/heads/master$  =   dilbert alice

The reason for treating "master$" as "refs/heads/master$" is that matching branches is the most common use so the syntax is optimised to make that simpler to write and easier to read. Anything not starting with refs/ (or NAME/, but that is out of scope for this document), is implicitly prefixed with refs/heads/.

The master$ is called a "refex" (a regex that matches a ref).

Dilbert and Alice can push to the "master" branch. Unless some other rule allows it, they cannot push to, say, "master1", "masterfull" etc., due to the $ at the end of the refex.

Refexes are prefix matched; i.e., treated as if they have a ^ at the start. (This means ^refs/heads/master in this case, not ^master, in case you forgot!)

This rule therefore does not match "headmaster", or even "refs/heads/refs/heads/master" (yes, it is possible to confuse yourself by pushing a branch like that in git).

        RW+     pu                  =   dilbert
        # again, remember this is equivalent to:
        RW+     refs/heads/pu       =   dilbert

Dilbert can push any branch whose name starts with "pu". This includes "pu1", "pupu", "pu/up", and so on, not just "pu". This is because there is no $ at the end.

        RW      junk/               =   wally

Wally can push any branch under "junk/", which means "junk/foo", "junk/bar", are ok but not "junk1" or even "junk".

        RW      tmp/                =   @all

Similar to above, but for any authenticated user.

        RW      refs/tags/v[0-9]    =   ashok   # the QA guy

Ashok is allowed to push version tags. He can push any tag whose name starts with a "v", then a digit, like "v1", "v1.0", "v2.0rc1", etc., but not "v-1", "ver1".