How to prevent gerrit push to authoritative repository

Question

We've been using gerrit for a few years, but we don't use the workflow described in the gerrit documentation. The developers who drove the adoption of gerrit and manaaged it for us are no longer here, unfortunately, so we have no local experts. We don't clone from gerrit, but instead clone from our authoratitive repository and have a 'gerrit' remote specified in our clones. Recently we had a user use the command:

git push gerrit master;refs/for/master/some_comment

Since the ';' terminated the command it became just

git push gerrit master

which actually pushed the commit to the master branch of the authoratative repository. However, it did so without executing the pre-recevie hook (or any hooks as near as I can tell) in the authoratative repository. We have two questions:

1. Is there a way to tell gerrit to reject this type of push? I tried setting the project to Read-only, but that also rejects correctly formatted change pushes.

2. If not, can we ensure that the hooks in the authoritative repository get executed?

Answer 1

To prevent direct pushes into the repository, remove the Push permission from refs/heads/* in the project's access controls.

The Push permission should remain on refs/for/refs/heads/* to allow developers to push changes for review.