From 8b6cc211e9a1692f847f3498f01aa5bec8bd765d Mon Sep 17 00:00:00 2001
From: Yunwen Zheng <yunwen.zheng@grafana.com>
Date: Fri, 7 Nov 2025 09:24:34 -0500
Subject: [PATCH] Git Sync: Allow user disable push to configured branch
 (#113564)

* Git Sync: Allow user disable push to configured branch
---
 .../provisioning/Config/ConfigForm.tsx        |  9 ++++++
 .../EnablePushToConfiguredBranchOption.tsx    | 28 +++++++++++++++++++
 .../features/provisioning/Config/defaults.ts  |  1 +
 .../provisioning/Wizard/FinishStep.tsx        | 10 +++++++
 public/app/features/provisioning/types.ts     |  1 +
 .../app/features/provisioning/utils/data.ts   |  3 +-
 public/locales/en-US/grafana.json             |  2 ++
 7 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 public/app/features/provisioning/Config/EnablePushToConfiguredBranchOption.tsx

diff --git a/public/app/features/provisioning/Config/ConfigForm.tsx b/public/app/features/provisioning/Config/ConfigForm.tsx
index 211422b0c2a..a29bc68329e 100644
--- a/public/app/features/provisioning/Config/ConfigForm.tsx
+++ b/public/app/features/provisioning/Config/ConfigForm.tsx
@@ -38,6 +38,7 @@ import { getHasTokenInstructions } from '../utils/git';
 import { getRepositoryTypeConfig, isGitProvider } from '../utils/repositoryTypes';
 
 import { ConfigFormGithubCollapse } from './ConfigFormGithubCollapse';
+import { EnablePushToConfiguredBranchOption } from './EnablePushToConfiguredBranchOption';
 import { getDefaultValues } from './defaults';
 
 // This needs to be a function for translations to work
@@ -303,6 +304,7 @@ export function ConfigForm({ data }: ConfigFormProps) {
               onChange: (e) => {
                 if (e.target.checked) {
                   setValue('prWorkflow', false);
+                  setValue('enablePushToConfiguredBranch', false);
                 }
               },
             })}
@@ -324,6 +326,13 @@ export function ConfigForm({ data }: ConfigFormProps) {
             />
           </Field>
         )}
+        {isGitBased && (
+          <EnablePushToConfiguredBranchOption<RepositoryFormData>
+            register={register}
+            registerName="enablePushToConfiguredBranch"
+            readOnly={readOnly}
+          />
+        )}
         {type === 'github' && <ConfigFormGithubCollapse register={register} />}
 
         {isGitBased && (
diff --git a/public/app/features/provisioning/Config/EnablePushToConfiguredBranchOption.tsx b/public/app/features/provisioning/Config/EnablePushToConfiguredBranchOption.tsx
new file mode 100644
index 00000000000..a164bebb7c7
--- /dev/null
+++ b/public/app/features/provisioning/Config/EnablePushToConfiguredBranchOption.tsx
@@ -0,0 +1,28 @@
+import { FieldValues, UseFormRegister, Path } from 'react-hook-form';
+
+import { t } from '@grafana/i18n';
+import { Checkbox, Field } from '@grafana/ui';
+
+export function EnablePushToConfiguredBranchOption<T extends FieldValues>({
+  register,
+  registerName,
+  readOnly,
+}: {
+  register: UseFormRegister<T>;
+  registerName: Path<T>;
+  readOnly: boolean;
+}) {
+  return (
+    <Field noMargin>
+      <Checkbox
+        disabled={readOnly}
+        {...register(registerName)}
+        label={t('provisioning.enable-push-to-configured-branch-label', 'Enable push to configured branch')}
+        description={t(
+          'provisioning.enable-push-to-configured-branch-description',
+          'Allow direct commits to the configured branch.'
+        )}
+      />
+    </Field>
+  );
+}
diff --git a/public/app/features/provisioning/Config/defaults.ts b/public/app/features/provisioning/Config/defaults.ts
index 65ab1bd84fa..7a8f27ae456 100644
--- a/public/app/features/provisioning/Config/defaults.ts
+++ b/public/app/features/provisioning/Config/defaults.ts
@@ -31,6 +31,7 @@ export function getDefaultValues({
         target: defaultTarget,
         intervalSeconds: 60,
       },
+      enablePushToConfiguredBranch: true,
     };
   }
   return specToData(repository);
diff --git a/public/app/features/provisioning/Wizard/FinishStep.tsx b/public/app/features/provisioning/Wizard/FinishStep.tsx
index 30a4749faaf..63f0f6b2504 100644
--- a/public/app/features/provisioning/Wizard/FinishStep.tsx
+++ b/public/app/features/provisioning/Wizard/FinishStep.tsx
@@ -5,6 +5,7 @@ import { Trans, t } from '@grafana/i18n';
 import { Checkbox, Field, Input, Stack, Text, TextLink } from '@grafana/ui';
 import { useGetFrontendSettingsQuery } from 'app/api/clients/provisioning/v0alpha1';
 
+import { EnablePushToConfiguredBranchOption } from '../Config/EnablePushToConfiguredBranchOption';
 import { checkImageRenderer, checkImageRenderingAllowed, checkPublicAccess } from '../GettingStarted/features';
 import { isGitProvider } from '../utils/repositoryTypes';
 
@@ -68,6 +69,7 @@ export const FinishStep = memo(function FinishStep() {
             onChange: (e) => {
               if (e.target.checked) {
                 setValue('repository.prWorkflow', false);
+                setValue('repository.enablePushToConfiguredBranch', false);
               }
             },
           })}
@@ -90,6 +92,14 @@ export const FinishStep = memo(function FinishStep() {
         </Field>
       )}
 
+      {isGitBased && (
+        <EnablePushToConfiguredBranchOption<WizardFormData>
+          register={register}
+          readOnly={readOnly}
+          registerName="repository.enablePushToConfiguredBranch"
+        />
+      )}
+
       {isGithub && imageRenderingAllowed && (
         <Field noMargin>
           <Checkbox
diff --git a/public/app/features/provisioning/types.ts b/public/app/features/provisioning/types.ts
index fe5783f3858..5603df43c04 100644
--- a/public/app/features/provisioning/types.ts
+++ b/public/app/features/provisioning/types.ts
@@ -44,6 +44,7 @@ export type RepositoryFormData = Omit<RepositorySpec, 'workflows' | RepositorySp
   LocalRepositoryConfig & {
     readOnly: boolean;
     prWorkflow: boolean;
+    enablePushToConfiguredBranch: boolean;
     // top-level inline secure value
     token?: string;
   };
diff --git a/public/app/features/provisioning/utils/data.ts b/public/app/features/provisioning/utils/data.ts
index 930e943d83b..4b3a0ad8833 100644
--- a/public/app/features/provisioning/utils/data.ts
+++ b/public/app/features/provisioning/utils/data.ts
@@ -6,7 +6,7 @@ export const getWorkflows = (data: RepositoryFormData): RepositorySpec['workflow
   if (data.readOnly) {
     return [];
   }
-  const workflows: RepositorySpec['workflows'] = ['write'];
+  const workflows: RepositorySpec['workflows'] = data.enablePushToConfiguredBranch ? ['write'] : [];
 
   if (!data.prWorkflow) {
     return workflows;
@@ -69,6 +69,7 @@ export const specToData = (spec: RepositorySpec): RepositoryFormData => {
     generateDashboardPreviews: spec.github?.generateDashboardPreviews || false,
     readOnly: !spec.workflows.length,
     prWorkflow: spec.workflows.includes('branch'),
+    enablePushToConfiguredBranch: spec.workflows.includes('write'),
   });
 };
 
diff --git a/public/locales/en-US/grafana.json b/public/locales/en-US/grafana.json
index 554150ef77d..79ae2cc323e 100644
--- a/public/locales/en-US/grafana.json
+++ b/public/locales/en-US/grafana.json
@@ -11510,6 +11510,8 @@
     "empty-state": {
       "no-jobs": "No jobs..."
     },
+    "enable-push-to-configured-branch-description": "Allow direct commits to the configured branch.",
+    "enable-push-to-configured-branch-label": "Enable push to configured branch",
     "enhanced-features": {
       "description": "Get the most out of your GitHub integration with these optional add-ons",
       "description-instant-updates": "Get instant updates in Grafana as soon as changes are committed. Review and approve changes using pull requests before they go live.",