Merge branch 'protect_default_branch_by_default' into 'master'

Protect default branch by default

Fixes #1543

See merge request !1130

CHANGELOG

@@ -3,6 +3,7 @@ v 7.4.0
   - Fix creating new files with web editor
   - Improve error reporting on users API (Julien Bianchi)
   - Refactor test coverage tools usage. Use SIMPLECOV=true to generate it locally
+  - Default branch is protected by default
   - Increase unicorn timeout to 60 seconds
   - Sort search autocomplete projects by stars count so most popular go first
   - Do not delete tmp/repositories itself during clean-up, only its contents

app/services/git_push_service.rb

@@ -29,6 +29,8 @@ class GitPushService
         if is_default_branch?(ref)
           # Initial push to the default branch. Take the full history of that branch as "newly pushed".
           @push_commits = project.repository.commits(newrev)
+          # Default branch is protected by default
+          project.protected_branches.create({ name: project.default_branch })
         else
           # Use the pushed commits that aren't reachable by the default branch
           # as a heuristic. This may include more commits than are actually pushed, but

spec/services/git_push_service_spec.rb

@@ -105,6 +105,8 @@ describe GitPushService do
     context "execute web hooks" do
       it "when pushing a branch for the first time" do
         project.should_receive(:execute_hooks)
+        project.default_branch.should == "master"
+        project.protected_branches.should_receive(:create).with({ name: "master" })
         service.execute(project, user, @blankrev, 'newrev', 'refs/heads/master')
       end