Git: is it possible to restrict clone/view specific branch for specific user

Question

Skip to TL;DR if you don't want to understand the context.

---

Context: I am handling internal team learning process, in which 1 of the assignment for the "student" (software engineer learning new tech/discipline) is to submit the project source code.

Since the learning material contains internal-only tech code, posting the assignment to github is out-of-scope. We have our own internal gitlab, so he said that what about simply submit as branch, but make that branch only accessible to evaluator and the submitter (so, student can't cheat other student project).

We don't want to create repo per student, as it will clutter our organization gitlab. Also: I don't want the students to submit as zip, as it's also clutter in local evaluator computer.

---

TL;DR: we want to make something like google codelabs, where student can clone barebone repo via private internal company gitlab, but they should submit their own assignment via their own "new branch" in the same repo, not "new repo". We want to make it private branch or anything that achieve that kind of goal.

Answer 1

In general, even if you could create private branches, they are typically not secure. Git provides a feature called namespaces that segments the references. In the manual page for that feature, it says:

The fetch and push protocols are not designed to prevent one side from stealing data from the other repository that was not intended to be shared. If you have private data that you need to protect from a malicious peer, your best option is to store it in another repository. This applies to both clients and servers. In particular, namespaces on a server are not effective for read access control; you should only grant read access to a namespace to clients that you would trust with read access to the entire repository.

All of this same text applies to all sorts of branch-specific access control mechanisms, whether using namespaces or not.

If you want to prevent other uses from getting access, you'd need to use separate repositories. In some environments, that might be a fork, although be aware that on some hosting platforms (e.g., GitHub) data in one fork is visible to all forks, which wouldn't work here. I know GitHub itself has a solution to this problem for educational platforms; perhaps GitLab has something similar.

Answer 2

We have our own internal gitlab

In that case, yes, in theory, you could limit the number of cloned repositories per user, but... only for GitLab Ultimate.

See GitLab 15.6 (November 2022)

Git abuse rate limiting

In GitLab 15.6, we’re introducing Git abuse rate limiting.

Enable this feature to automatically notify administrators when a user downloads or clones more than a specified number of repositories in a group or any of its subgroups within a given time frame.

You can also automatically ban users who exceed the rate limit. Banned users cannot access the main group or any of its non-public subgroups. Access to unrelated groups is unaffected. Bans are permanent by default, but group administrators can always unban a banned user.

See Documentation and Issue.