Mercurial Branch
You create a mercurial branch by marking a commit with a permanent branch name. Every commit you make after that point inherits the same mercurial branch label. Engineering teams use these branches to separate stable releases from active feature work. Still, broad repo permissions often let any developer push changes to protected lines. When roles lack strict boundaries, one bad push can corrupt a release history. How a mercurial branch works in your repository Mercurial handles branching in
Branch Protection Rules: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You create a mercurial branch by marking a commit with a permanent branch name. Every commit you make after that point inherits the same mercurial branch label. Engineering teams use these branches to separate stable releases from active feature work. Still, broad repo permissions often let any developer push changes to protected lines. When roles lack strict boundaries, one bad push can corrupt a release history.
How a mercurial branch works in your repository
Mercurial handles branching in a different way than other version control tools. In Mercurial, a named branch is baked directly into the commit metadata. You cannot delete or rename that branch label once you commit the change. This design makes named branches great for long-term release tracks and major versions.
Every commit knows its exact branch name forever. When you check the project log, you see which line holds each change. Teams often use the default branch for daily work and create release branches later. This setup keeps the main line clean while older versions get safe fixes.
For short tasks, developers often pick bookmarks instead of full named branches. A bookmark is a movable pointer that works like a lightweight branch tag. You can delete a bookmark after you merge your feature into the main line. This choice prevents hundreds of old feature labels from cluttering your permanent commit log.
Choosing between named branches and bookmarks
Picking the right branching model depends on how long the code line lives. Named branches fit work that your team must track for months or years. Auditors and release managers can trace every bug fix back to its exact version. Because the name stays in the history, nobody can erase the audit trail.
Bookmarks fit quick bug fixes and small features that finish in a few days. Two developers can work on their own bookmarks without adding permanent metadata noise. Once the team reviews the code, they merge the changes and drop the label. Most teams mix both methods to keep their history clean and easy to read.
Branch Protection Rules: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native branch permissions solve and what they miss
Source control servers let you set up role rules for who can read or write. You can block junior developers from pushing commits to a production release branch. These server checks run when a developer tries to send new commits upstream. If the user lacks the right role, the server rejects the whole push.
Still, repo permissions only check who logs in to push or pull code. They do not govern what happens when developers run commands on live servers. Many teams link branch updates to scripts that run database queries or server tasks. A developer with valid branch rights might trigger a script with broad admin keys.
Static repo roles cannot inspect live commands or mask sensitive data in query results. If a script pulls customer records during a test, raw emails or card numbers appear. Native source control rules stop bad pushes, but they leave live server sessions wide open. Teams need runtime controls that check every command and rewrite sensitive fields in results.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Can you delete a named mercurial branch after pushing it?
No, you cannot delete a named branch because the name lives inside each commit. You can only close the branch so it hides from active branch lists.
When should a team use bookmarks instead of named branches?
Use bookmarks for short feature work that you plan to merge within days. Use named branches for long-lived release tracks that need a permanent history record.
How do teams stop accidental pushes to a release branch?
Admins set up server-side hooks on the central repo to check user roles. These hooks reject any push that contains commits on a restricted branch name.