Is there a good way to restrict read (fetch) on per branch basis in git?

Question

I am open to using tools and strategies around git. Essentially, we want to expose a subset of the branches on a repository to Read or Read/Write for a set of users. Another subset of branches would not even be known to those users.

Answer 1

Use two separate repositories, one public one private, and don't push the private branches to the public repository.

You could use a update hook in the public repository to deny pushes that try to push those private branches, in order to avoid accidentally pushing the private branches to the public repository. You could also use a pre-receive hook if you want to block the entire push if someone accidentally tries to push a private branch, instead of just blocking the creation of that branch.

You could also simply use the sample update hook in the public repository (rename it from update.sample to update, and ensure that it is executable), and set the hooks.denycreatebranch configuration setting to deny creation of any new branches in the public repo, only allowing it to contain branches that already exist or which are created locally in that repo.