The tag protection as part of branch protection is documented here:
https://confluence.atlassian.com/stash/branch-permission-patterns-313461041.html
A refernce to this documentation should suffice for now, as it provides a valid workaround, which we already use successfully.

Hi xabierdavila,

I've linked to a related issue where we'll track the suggestion for better tag protection: STASH-3794.

In the meantime, it is already possible to protect tags by using a branch pattern match and explicitly entering a pattern using the full ref form, eg: refs/tags/foo-*

We'll get this fixed up in the documentation.

I'm disappointed this issue has been closed without fixing the tag deletion issue.
I'm using Stash 3.11.1 and still can delete tags via

git push origin :refs/tags/foo-1.2.3

Starting with Stash 3.10.0 branch permissions can now "Prevent branch deletion". This will prevent deleting the branch both in the Stash UI as well as via pushes.

I don't believe my plugin does that, but If I am not mistaken the plugin api would allow you to intercept that type of event.

@michael.rappazzo

I'm guessing your plugin also doesn't catch the stash merge delete issue I mentioned either?

My company found the stash permissions lacking, so I was tasked to write a plugin which has more fined grained permissions. I made it use a syntax similar to gitolite (with RW+CD for permissions, regex branch names, and then user or group association), and added some of my own features. It didn't really take too long, so I would recommend this approach until stash catches up. We have been quite satisfied with this approach. Unfortunately, I can't release the source code at this point because it is a private company resource.

Another month, another comment to keep this thing alive.

Our organization has lost two release branches as a result of "branch permissions" not actually preventing all the methods in which a user can delete a branch. We've installed the "Protect Branches" Plugin, the "Protect Branches with unmerged pull requests" hook and configured the built in branch permissions and yet there is still a way to delete branches via the UI. Please make the branch permissions do what they advertise.

it is bad that an user can delete the branches from UI even though STASH application has various level of permission inheritance and blocking an access at branch level, but just because of this issue, other features for restrictions is not worth.

Can STASH take this as a critical issue and develop a fix for this

Will that plugin also prevent deletion of the branch in the Stash Merge UI, where the "Delete Source Branch After Merging" tickbox is?

EDIT: Sadly it seems not to.