Enforcing Commit Standards with Towergit’s Protected Branch Rules

Why Commit Standards Matter

In a team that relies on trunk‑based development, a single mis‑tagged or force‑pushed commit can corrupt the entire history. Teams also struggle to keep a consistent commit‑message style, which makes automated changelog generation and issue tracking brittle. The solution is to enforce rules at the repository level, not just through local hooks that can be ignored.

What Towergit’s Protected Branch Rules Do

Protected branch rules in Git Tower are declarative policies that live in the Tower UI or via the Tower API. They apply to the remote repository, not to a local clone. Key features include:

• No force pushes – the server rejects any push that rewrites history on a protected branch.
• Signed commits only – commits must be signed with a GPG key, ensuring authenticity.
• Commit‑message regex enforcement – a regular expression can be set to validate every commit message before it is accepted.
• Pull‑request approval requirement – a branch can be configured to allow merges only after at least one reviewer approves the PR.

These rules are enforced server‑side, so they survive even if developers use the command line or other Git clients.

Setting Up the Rules in the Tower UI

1. Open your repository in Tower. Note: you need at least a repository admin role.

2. Click Branch Settings on the left pane. Choose the branch you want to protect (e.g., main).

3. Toggle Protect Branch. Then configure the following sub‑settings:

• Push – set to Protected to block all pushes that would alter history.
• Force Push – set to Protected to disallow force pushes.
• Signed Commits – enable to require git commit -S signatures.
• Commit Message Pattern – paste a regex. For example, ^ABC-\d+\s.+ enforces the ABC-1234 ticket prefix.
• Pull Request Approvals – set Minimum Approvals to 1 and optionally select a team or individual.

Click Save Settings. Tower will apply the policy to the remote branch immediately.

Configuring the Same Rules via the Tower API

For CI pipelines or automated onboarding, the Tower API can be used. Below is a minimal example using curl:

curl -X PATCH \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
  "pushProtection": "PROTECTED",
  "forcePushProtection": "PROTECTED",
  "signedCommits": true,
  "commitMessagePattern": "^ABC-\\d+\\s.+",
  "pullRequestApprovals": {
    "minimumApprovals": 1
  }
}' \
  https://api.tower.com/v1/repositories/<REPO_ID>/branches/main

Replace <YOUR_API_TOKEN> and <REPO_ID> with your credentials. The API mirrors the UI settings and can be version‑controlled.

Worked Example: Enforcing “ABC‑1234 – Feature” Commit Messages

Suppose your team uses Jira tickets prefixed with ABC‑. You want every commit to start with that ticket and a short description, and you want each PR to be approved before merging.

1. Define the regex: ^ABC-\d+\s.+. This matches ABC‑1234 – Add login page.
2. Apply the rule in Tower: Follow the UI steps above, paste the regex, enable Signed Commits, and set Minimum Approvals to 1.
3. Test the rule locally: In a clone, try committing normally:

   git commit -m "Add login page"
   # Tower rejects the push with a message:
   # "Commit message does not match the required pattern: ^ABC-\d+\s.+"
   

4. Sign the commit and include the ticket:

git commit -S -m "ABC-1234 – Add login page"
git push origin main
# Tower accepts the push.

5. Open a pull request in Tower, assign a reviewer, and wait for approval. Only after approval can the PR be merged.

Limitations and Practical Checks

• Scope of protection: The rules apply only to pushes made through Tower or the Tower API. Developers who bypass Tower and push directly to the remote with git push will still be subject to the server‑side protections, but if your Git hosting provider does not enforce the same policies, they could circumvent Tower’s rules. Always configure server‑side hooks or use a hosting service that respects Tower’s settings.
• Over‑restrictiveness: Requiring signed commits and a PR approval on every branch can slow down rapid iteration. For experimental branches, consider disabling Signed Commits or setting Minimum Approvals to 0.
• Verification: After setting the rules, run git remote show origin and inspect the receive.denyCurrentBranch and receive.denyDeleteCurrent settings on the server. They should reflect Tower’s protection status.
• Version compatibility: Protected branch rule granularity varies across Tower releases. Check the official changelog for your version to confirm that per‑branch commit‑message patterns are supported.

Actionable Takeaway

By declaratively enabling protected branch rules in Git Tower, teams can:

• Guarantee that all commits are signed and follow a consistent message format.
• Prevent accidental force pushes that could corrupt shared history.
• Ensure that every change is reviewed before merging, reducing merge conflicts in trunk‑based workflows.

Implement the policy in Tower’s UI or API, verify the server‑side settings, and adjust the strictness based on your team’s velocity needs. This single, declarative change can dramatically improve codebase hygiene without the maintenance overhead of client‑side hooks.