[PunchyHamster]

> That's not something that you can do in git: it's all or nothing.

That is partially incorrect; you can restrict writes via hooks but not reads; you'd need a workaround like submodules

[jmaw]

Does `--no-verify` override the restriction via hooks, or are there some kind of server-side hooks that can be used?

[PunchyHamster]

no-verify cancels local hooks, remote hooks are unaffected.

Gitolite supports per-diectory/file write access natively, for gitlab you'd probably need to write your own.

[jmaw]

Interesting. I'll have to do so reading into remote hooks!