Enforce Disallow Branch Deletion using data collected by GitLab Collector. Automatically check repository and ownership standards on every PR.
How GitLab Collector Powers This Guardrail
The GitLab Collector gathers metadata from your vcs systems. This data flows into Lunar's Component JSON, where the Disallow Branch Deletion guardrail evaluates it against your standards.
When enabled, this check runs automatically on every PR and in AI coding workflows, providing real-time enforcement with actionable feedback.
Quick Start Configuration
Add both the collector and policy to your lunar-config.yml to enable this guardrail.
# Step 1: Enable the GitLab Collector
collectors:
- uses: github://earthly/lunar-lib/collectors/gitlab@v1.0.5
# with: ...
# Step 2: Enable the VCS Guardrails
policies:
- uses: github://earthly/lunar-lib/policies/vcs@v1.0.5
include: [disallow-branch-deletion]
# with: ...What GitLab Collector Collects
This collector gathers the following data that the Disallow Branch Deletion guardrail evaluates.
merge-request
Fetches merge-request metadata from the GitLab API for the MR being evaluated and writes it under .vcs.pr — title, description, source and target branch, author, labels, draft flag, state, URL, and number. This is the GitLab source of .vcs.pr.* that the ticket collectors (jira, linear) and change-management / change-to-ticket checks read. Runs only in merge-request context.
repository
Fetches basic project settings from the GitLab API including visibility (public/internal/private), default branch, topics, and the configured merge method (merge commit, rebase, fast-forward) plus squash options. Writes to .vcs.provider, .vcs.visibility, .vcs.default_branch, .vcs.topics, and .vcs.merge_strategies.
branch-protection
Fetches protected-branch config, MR approval rules, external status checks, and push rules for the default branch from the GitLab API, normalizing them into the shared .vcs.branch_protection shape with a .source field of "gitlab". Collects required approvals (from approval rules), code-owner approval, reset-on-push (dismiss stale reviews), required status checks (pipeline-success and/or external status checks, with their names in required_checks), signed-commit and linear-history enforcement, allowed force push, and push/merge access levels. Licensed- only signals degrade gracefully to their safe defaults on CE/unlicensed.
access-permissions
Fetches project access permissions from the GitLab API with pagination. Collects direct project members (username, access level, type) and shared groups (path, name, access level). Does not expand group memberships. Writes to .vcs.access.collaborators and .vcs.access.teams.
Example Data Flow
Here's an example of the data that GitLab Collector writes to the Component JSON, which Disallow Branch Deletion then evaluates.
{
"vcs": {
"provider": "gitlab",
"default_branch": "main",
"visibility": "private",
"topics": ["backend", "api", "microservice"],
"merge_strategies": {
"allow_merge_commit": false,
"allow_squash_merge": true,
"allow_rebase_merge": true
},
"pr": {
"number": 42,
"title": "[ENG-123] Add rate limiting to the auth service",
"description": "Implements a token-bucket limiter. Closes ENG-123.",
"url": "https://gitlab.com/acme/auth-service/-/merge_requests/42",
"source_branch": "eng-123-rate-limiting",
"target_branch": "main",
"author": "alice",
"labels": ["backend", "security"],
"draft": false,
"state": "open"
},
"branch_protection": {
"enabled": true,
"source": "gitlab",
"branch": "main",
"require_pr": true,
"required_approvals": 2,
"require_codeowner_review": true,
"dismiss_stale_reviews": true,
"require_status_checks": true,
"required_checks": ["security-gate"],
"require_signed_commits": false,
"require_linear_history": false,
"allow_force_push": false,
"allow_deletions": false,
"restrictions": {
"push_access_level": "maintainer",
"merge_access_level": "developer"
}
},
"access": {
"collaborators": [
{"username": "alice", "permission": "owner", "type": "User"},
{"username": "deploy-bot", "permission": "developer", "type": "Bot"}
],
"teams": [
{"slug": "platform", "name": "Platform Team", "permission": "maintainer"}
]
}
}
}Configuration Options
GitLab Collector Inputs
| Input | Required | Default | Description |
|---|---|---|---|
gitlab_host |
Optional |
gitlab.com
|
GitLab host for self-managed instances (e.g. gitlab.example.com) |
VCS Guardrails Inputs
| Input | Required | Default | Description |
|---|---|---|---|
min_approvals |
Optional |
1
|
Minimum number of required approvals (integer, or omit to skip check) |
required_default_branch |
Optional |
main
|
Required default branch name for the require-default-branch policy. Defaults to 'main' |
allowed_merge_strategies |
Required | — | Comma-separated list of allowed merge strategies for the allowed-merge-strategies policy (merge, squash, rebase). Only listed strategies will be allowed |
Ready to Automate Your Standards?
See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 200+ built-in guardrails.
AI agent rules & prompt files
Post-mortem action items
Security & compliance policies
Testing & quality requirements