說下我場景需求
一姥卢、因為項目是使用gitlab-ci來發(fā)布到生產(chǎn)池磁，所以會存在相關(guān)開發(fā)人員可能會去修改gitlab-ci配置文件再登，為了保證這個文件只有指定人修改
所以我們在git鉤子限制腿椎。
二优烧、項目中生產(chǎn)配置文件不允許開發(fā)人員隨便修改佃蚜，只有指定人員才可以修改庸娱。
一.首先我們要找到我們我們項目代碼存放gitlab位置
1.查看項目id
登錄gitlab后臺找到對應項目id截圖如下：
image.png
我的項目id是25
2.項目id轉(zhuǎn)字符串
因為gitlab存放我們的項目路徑不是直接根據(jù)項目保存的，需要對項目id轉(zhuǎn)義命令如下
echo -n 25 | sha256sum
命令中的25是我自己項目id谐算，這個填寫你們實際項目id
回車后顯示一串字符串
[root@suoyoubao ~]# echo -n 25 | sha256sum
b7a56873cd771f2c446d369b649430b65a756ba278ff97ec81bb6f55b2e73569 -
3.找到gitlab中項目存放的位置
然后我們再把這串字符串查到我們項目存放所在位置命令如下：
find / -name b7a56873cd771f2c446d369b649430b65a756ba278ff97ec81bb6f55b2e73569.git
結(jié)果如下：
[root@suoyoubao ~]# find / -name b7a56873cd771f2c446d369b649430b65a756ba278ff97ec81bb6f55b2e73569.git
/var/opt/gitlab/git-data/repositories/@hashed/b7/a5/b7a56873cd771f2c446d369b649430b65a756ba278ff97ec81bb6f55b2e73569.git
4.找到需要編寫腳本的位置
先cd到我們剛才查出來的文件路徑熟尉，項目根目錄有個custom_hooks文件夾如果沒有自己創(chuàng)建，cd到custom_hooks里面新建命名為pre-receive文件
[root@suoyoubao /]# cd /var/opt/gitlab/git-data/repositories/@hashed/b7/a5/b7a56873cd771f2c446d369b649430b65a756ba278ff97ec81bb6f55b2e73569.git
[root@suoyoubao b7a56873cd771f2c446d369b649430b65a756ba278ff97ec81bb6f55b2e73569.git]# ls
branches config custom_hooks description HEAD hooks info language-stats.cache objects packed-refs refs
[root@suoyoubao b7a56873cd771f2c446d369b649430b65a756ba278ff97ec81bb6f55b2e73569.git]# cd custom_hooks/
[root@suoyoubao custom_hooks]# ls
pre-receive
[root@suoyoubao custom_hooks]#
5.根據(jù)自己的需求修改下面腳本來限制只有指定的人可以修改指定文件
我這邊是只允許root和syb用戶才能修改
指定文件為：.gitlab-ci.yml洲脂，application-pro.yml 斤儿，bootstrap-pro.yml 三個文件
這里自己可以自己定義
附上腳本：
#!/usr/bin/env bash
#Fork hook from https://github.com/github/platform-samples/tree/master/pre-receive-hooks
#
# Pre-receive hook that will block any new commits that contain files ending
# with .gz, .zip or .tgz
#
# More details on pre-receive hooks and how to apply them can be found on
# https://help.github.com/enterprise/admin/guides/developer-workflow/managing-pre-receive-hooks-on-the-github-enterprise-appliance/
#
zero_commit="0000000000000000000000000000000000000000"
# Do not traverse over commits that are already in the repository
# (e.g. in a different branch)
# This prevents funny errors if pre-receive hooks got enabled after some
# commits got already in and then somebody tries to create a new branch
# If this is unwanted behavior, just set the variable to empty
echo $GL_USERNAME
# 定義允許哪些用戶可以對指定文件修改
AGREE_USER=("root" "syb")
# 指定文件
MANAGE_FILES=(".gitlab-ci.yml" "application-pro.yml" "bootstrap-pro.yml")
# 是否過濾指定文件
IS_FILTER= 0
# 判斷當前提交的用戶是否在授權(quán)用戶列表中
EXIT_USER=0
excludeExisting="--not --all"
while read oldrev newrev refname; do
# echo "payload"
echo $refname $oldrev $newrev
# branch or tag get deleted
if [ "$newrev" = "$zero_commit" ]; then
continue
fi
# Check for new branch or tag
if [ "$oldrev" = "$zero_commit" ]; then
span=`git rev-list $newrev $excludeExisting`
else
span=`git rev-list $oldrev..$newrev $excludeExisting`
fi
for COMMIT in $span; do
for FILE in `git log -1 --name-only --pretty=format:'' $COMMIT`; do
for(( i=0;i<${#MANAGE_FILES[@]};i++)) do
if [[ "$FILE" == *${MANAGE_FILES[i]} ]];then
IS_FILTER=1
fi
done
done
done
done
for(( i=0;i<${#AGREE_USER[@]};i++)) do
if [[ ${AGREE_USER[i]} == $GL_USERNAME ]];then
EXIT_USER=1
fi
done
if [ $IS_FILTER == 1 ] && [ $EXIT_USER != 1 ]; then
# if [ $IS_YML == 1 ]; then
#if [ $EXIT_USER == 1 ]; then
exit 1
fi
exit 0
