Merge branch '29662-allow-unauthenticated-branches-api' into 'master'

Allow unauthenticated access to some Branch API GET endpoints

Closes #29662

See merge request !10077

changelogs/unreleased/29662-allow-unauthenticated-branches-api.yml

+---
+title: Allow unauthenticated access to some Branch API GET endpoints
+merge_request:
+author:

doc/api/branches.md

@@ -3,6 +3,8 @@
 ## List repository branches
 
 Get a list of repository branches from a project, sorted by name alphabetically.
+This endpoint can be accessed without authentication if the repository is
+publicly accessible.
 
 ```
 GET /projects/:id/repository/branches
@@ -48,7 +50,8 @@ Example response:
 
 ## Get single repository branch
 
-Get a single project repository branch.
+Get a single project repository branch. This endpoint can be accessed without
+authentication if the repository is publicly accessible.
 
 ```
 GET /projects/:id/repository/branches/:branch

lib/api/branches.rb

@@ -4,7 +4,6 @@ module API
   class Branches < Grape::API
     include PaginationParams
 
-    before { authenticate! }
     before { authorize! :download_code, user_project }
 
     params do
@@ -102,6 +101,7 @@ module API
       end
       post ":id/repository/branches" do
         authorize_push_project
+
         result = CreateBranchService.new(user_project, current_user).
                  execute(params[:branch], params[:ref])