Merge branch 'stable-3.2' into stable-3.3 * stable-3.2: Update Jenkins repository URL Change-Id: I747fe295e1066176203c2c52b70a3f3fef898065

diff --git a/README.md b/README.md
index a914ac0..d01069d 100644
--- a/README.md
+++ b/README.md

@@ -66,14 +66,25 @@
 How to build this plugin
 ------------------------
 
-### Gerrit 2.10 build
+### Gerrit 3.3 build
 
-GitHub plugin is designed to work with Gerrit 2.10 (currently in development).
-In order to build the GitHub plugin you need to have a working Gerrit 2.10
+GitHub plugin is designed to work with Gerrit 3.3 (currently in development).
+In order to build the GitHub plugin you need to have a working Gerrit 3.3
 build in place.
 
-See https://gerrit-review.googlesource.com/Documentation/dev-buck.html for a
-reference on how to build Gerrit 2.10 (master branch) using BUCK.
+See https://gerrit-review.googlesource.com/Documentation/dev-bazel.html for a
+reference on how to build Gerrit using Bazel.
+
+Gerrit 3.3 is distributed for Java 11 only. However, the source code is compatible
+with Java 8 assuming you build it from the source repository by yourself.
+
+The GitHub plugin can be built for Java 8 by using the `javaVersion=1.8` Maven
+parameter.
+
+Example:
+  git clone https://gerrit.googlesource.com/plugins/github
+  cd github
+  mvn -DjavaVersion=1.8 install
 
 ### GitHub API
 
@@ -90,17 +101,17 @@
 
 ### singleusergroup plugin
 
-You need to clone, build and install the singleusergroup plugin for Gerrit
+You need to install the singleusergroup plugin for Gerrit
 (see https://gerrit-review.googlesource.com/#/admin/projects/plugins/singleusergroup).
 
 This plugin is needed to allow Gerrit to use individual users as Groups for being
-used in Gerrit ACLs. As of Gerrit 2.10 singleuserplugin is a core plugin and
+used in Gerrit ACLs. As of Gerrit 3.3 singleuserplugin is a core plugin and
 included in Gerrit tree (if it was cloned recursively).
 
 Example:
   cd gerrit
-  buck build plugins/singleusergroup
-  cp buck-out/gen/plugins/singleusergroup/singleusergroup.jar $GERRIT_SITE/plugins/.
+  bazelisk build plugins/singleusergroup
+  cp bazel-bin/plugins/singleusergroup/singleusergroup.jar $GERRIT_SITE/plugins/.
 
 ### Building GitHub integration for Gerrit
 
@@ -179,3 +190,22 @@
 
 After the installation, Eclipse must be restarted and compilation
 errors should disappear.
+
+### Notes
+
+#### Magic refs
+
+Before importing a repository from github, this plugin checks that its git refs
+do not clash with Gerrit magic refs, since importing those refs would prevent
+users from creating change requests.
+
+Attempting to import repositories having refs starting with `refs/for/` or
+`refs/meta` will fail with an error message.
+For example:
+
+```text
+Found 2 ref(s): Please remove or rename the following refs and try again:
+  refs/for/foo, refs/meta/bar
+```
+
+More information on Gerrit magic refs can be found [here](https://gerrit-review.googlesource.com/Documentation/intro-user.html#upload-change)
\ No newline at end of file

diff --git a/github-oauth/pom.xml b/github-oauth/pom.xml
index 8f5b708..7a45b1d 100644
--- a/github-oauth/pom.xml
+++ b/github-oauth/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <groupId>com.googlesource.gerrit.plugins.github</groupId>
     <artifactId>github-parent</artifactId>
-    <version>3.2.1</version>
+    <version>3.3.0</version>
   </parent>
   <artifactId>github-oauth</artifactId>
   <name>Gerrit Code Review - GitHub OAuth login</name>
@@ -107,7 +107,12 @@
     <dependency>
       <groupId>org.kohsuke</groupId>
       <artifactId>github-api</artifactId>
-      <version>1.70</version>
+      <version>1.116</version>
+    </dependency>
+    <dependency>
+      <groupId>com.infradna.tool</groupId>
+      <artifactId>bridge-method-injector</artifactId>
+      <version>1.18</version>
     </dependency>
     <dependency>
       <groupId>org.apache.httpcomponents</groupId>

diff --git a/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/GitHubMyselfWrapper.java b/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/GitHubMyselfWrapper.java
index 2336521..247d6a6 100644
--- a/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/GitHubMyselfWrapper.java
+++ b/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/GitHubMyselfWrapper.java

@@ -14,7 +14,6 @@
 
 package com.googlesource.gerrit.plugins.github.oauth;
 
-import com.infradna.tool.bridge_method_injector.WithBridgeMethods;
 import java.io.IOException;
 import java.net.URL;
 import java.util.Date;
@@ -111,13 +110,11 @@
   }
 
   @Override
-  @WithBridgeMethods({Set.class})
   public GHPersonSet<GHUser> getFollows() throws IOException {
     return wrapped.getFollows();
   }
 
   @Override
-  @WithBridgeMethods({Set.class})
   public GHPersonSet<GHUser> getFollowers() throws IOException {
     return wrapped.getFollowers();
   }
@@ -143,7 +140,6 @@
   }
 
   @Override
-  @WithBridgeMethods({Set.class})
   public GHPersonSet<GHOrganization> getOrganizations() throws IOException {
     try {
       return wrapped.getOrganizations();
@@ -269,18 +265,12 @@
   }
 
   @Override
-  @WithBridgeMethods(
-      value = {String.class},
-      adapterMethod = "urlToString")
   public URL getUrl() {
     return wrapped.getUrl();
   }
 
   @Override
-  @WithBridgeMethods(
-      value = {String.class},
-      adapterMethod = "intToString")
-  public int getId() {
+  public long getId() {
     return wrapped.getId();
   }
 }

diff --git a/github-plugin/pom.xml b/github-plugin/pom.xml
index df57ec6..58fcd13 100644
--- a/github-plugin/pom.xml
+++ b/github-plugin/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <artifactId>github-parent</artifactId>
     <groupId>com.googlesource.gerrit.plugins.github</groupId>
-    <version>3.2.1</version>
+    <version>3.3.0</version>
   </parent>
 
   <artifactId>github-plugin</artifactId>

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/GuiceHttpModule.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/GuiceHttpModule.java
index 12acdb2..f75030d 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/GuiceHttpModule.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/GuiceHttpModule.java

@@ -24,6 +24,8 @@
 import com.googlesource.gerrit.plugins.github.git.GitCloneStep;
 import com.googlesource.gerrit.plugins.github.git.GitHubRepository;
 import com.googlesource.gerrit.plugins.github.git.GitImporter;
+import com.googlesource.gerrit.plugins.github.git.MagicRefCheckStep;
+import com.googlesource.gerrit.plugins.github.git.ProtectedBranchesCheckStep;
 import com.googlesource.gerrit.plugins.github.git.PullRequestImportJob;
 import com.googlesource.gerrit.plugins.github.git.ReplicateProjectStep;
 import com.googlesource.gerrit.plugins.github.notification.WebhookServlet;
@@ -51,6 +53,10 @@
 
     install(
         new FactoryModuleBuilder()
+            .implement(ProtectedBranchesCheckStep.class, ProtectedBranchesCheckStep.class)
+            .build(ProtectedBranchesCheckStep.Factory.class));
+    install(
+        new FactoryModuleBuilder()
             .implement(GitCloneStep.class, GitCloneStep.class)
             .build(GitCloneStep.Factory.class));
     install(
@@ -63,6 +69,10 @@
             .build(ReplicateProjectStep.Factory.class));
     install(
         new FactoryModuleBuilder()
+            .implement(MagicRefCheckStep.class, MagicRefCheckStep.class)
+            .build(MagicRefCheckStep.Factory.class));
+    install(
+        new FactoryModuleBuilder()
             .implement(PullRequestImportJob.class, PullRequestImportJob.class)
             .build(PullRequestImportJob.Factory.class));
     install(

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/AbstractCloneJob.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/AbstractCloneJob.java
index 4421841..753575f 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/AbstractCloneJob.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/AbstractCloneJob.java

@@ -26,6 +26,9 @@
 
   protected String getErrorDescription(Throwable exception) {
     LOG.error("Job " + this + " FAILED", exception);
+    if (exception instanceof ProtectedBranchFoundException) {
+      return exception.getMessage();
+    }
     if (GitException.class.isAssignableFrom(exception.getClass())) {
       return ((GitException) exception).getErrorDescription();
     } else if (ProvisionException.class.isAssignableFrom(exception.getClass())) {

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/CreateProjectStep.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/CreateProjectStep.java
index 9c26310..870a13b 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/CreateProjectStep.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/CreateProjectStep.java

@@ -13,13 +13,13 @@
 // limitations under the License.
 package com.googlesource.gerrit.plugins.github.git;
 
-import com.google.gerrit.common.data.AccessSection;
-import com.google.gerrit.common.data.GroupDescription;
-import com.google.gerrit.common.data.GroupReference;
-import com.google.gerrit.common.data.Permission;
-import com.google.gerrit.common.data.PermissionRule;
+import com.google.gerrit.entities.AccessSection;
 import com.google.gerrit.entities.AccountGroup;
 import com.google.gerrit.entities.BooleanProjectConfig;
+import com.google.gerrit.entities.GroupDescription;
+import com.google.gerrit.entities.GroupReference;
+import com.google.gerrit.entities.Permission;
+import com.google.gerrit.entities.PermissionRule;
 import com.google.gerrit.entities.Project;
 import com.google.gerrit.entities.Project.NameKey;
 import com.google.gerrit.extensions.client.InheritableBoolean;
@@ -106,47 +106,54 @@
         Permission.SUBMIT,
         Permission.REBASE);
 
-    PermissionRule reviewRange = new PermissionRule(getMyGroup());
-    reviewRange.setMin(new Integer(-2));
-    reviewRange.setMax(new Integer(+2));
-    addPermission(CODE_REVIEW_REFS, Permission.LABEL + CODE_REVIEW_LABEL, reviewRange);
+    PermissionRule.Builder reviewRangeBuilder = PermissionRule.create(getMyGroup()).toBuilder();
+    reviewRangeBuilder.setMin(-2).setMax(2);
+    addPermission(
+        CODE_REVIEW_REFS, Permission.LABEL + CODE_REVIEW_LABEL, reviewRangeBuilder.build());
 
-    PermissionRule verifiedRange = new PermissionRule(getMyGroup());
-    verifiedRange.setMin(new Integer(-1));
-    verifiedRange.setMax(new Integer(+1));
-    addPermission(CODE_REVIEW_REFS, Permission.LABEL + VERIFIED_LABEL, verifiedRange);
+    PermissionRule.Builder verifiedRangeBuilder = PermissionRule.create(getMyGroup()).toBuilder();
+    verifiedRangeBuilder.setMin(-1).setMax(1);
+    addPermission(
+        CODE_REVIEW_REFS, Permission.LABEL + VERIFIED_LABEL, verifiedRangeBuilder.build());
 
     addPermissions(AccessSection.HEADS, Permission.READ, Permission.CREATE, Permission.PUSH_MERGE);
 
-    PermissionRule forcePush = new PermissionRule(getMyGroup());
-    forcePush.setForce(Boolean.TRUE);
-    addPermission(AccessSection.HEADS, Permission.PUSH, forcePush);
+    PermissionRule.Builder forcePushBuilder = PermissionRule.create(getMyGroup()).toBuilder();
+    forcePushBuilder.setForce(true);
+    addPermission(AccessSection.HEADS, Permission.PUSH, forcePushBuilder.build());
 
     addPermissions(TAGS_REFS, Permission.PUSH);
 
-    PermissionRule removeTag = new PermissionRule(getMyGroup());
-    removeTag.setForce(Boolean.TRUE);
-    addPermission(TAGS_REFS, Permission.PUSH, removeTag);
+    PermissionRule.Builder removeTagBuilder = PermissionRule.create(getMyGroup()).toBuilder();
+    removeTagBuilder.setForce(true);
+    addPermission(TAGS_REFS, Permission.PUSH, removeTagBuilder.build());
   }
 
   private void addPermissions(String refSpec, String... permissions) {
-    AccessSection accessSection = projectConfig.getAccessSection(refSpec, true);
-    for (String permission : permissions) {
-      String[] permParts = permission.split("=");
-      String action = permParts[0];
-      PermissionRule rule;
-      if (permParts.length > 1) {
-        rule = PermissionRule.fromString(permParts[1], true);
-        rule.setGroup(getMyGroup());
-      } else {
-        rule = new PermissionRule(getMyGroup());
-      }
-      accessSection.getPermission(action, true).add(rule);
-    }
+    projectConfig.upsertAccessSection(
+        refSpec,
+        as -> {
+          for (String permission : permissions) {
+            String[] permParts = permission.split("=");
+            String action = permParts[0];
+            PermissionRule.Builder ruleBuilder;
+            if (permParts.length > 1) {
+              ruleBuilder =
+                  PermissionRule.fromString(permParts[1], true).toBuilder().setGroup(getMyGroup());
+            } else {
+              ruleBuilder = PermissionRule.builder(getMyGroup());
+            }
+            as.upsertPermission(action).add(ruleBuilder);
+          }
+        });
   }
 
   private void addPermission(String refSpec, String action, PermissionRule rule) {
-    projectConfig.getAccessSection(refSpec, true).getPermission(action, true).add(rule);
+    projectConfig.upsertAccessSection(
+        refSpec,
+        as -> {
+          as.upsertPermission(action).add(rule.toBuilder());
+        });
   }
 
   private GroupReference getMyGroup() {
@@ -181,15 +188,17 @@
   }
 
   private void setProjectSettings() {
-    Project project = projectConfig.getProject();
-    project.setParentName(config.getBaseProject(getRepository().isPrivate()));
-    project.setDescription(description);
-    project.setSubmitType(SubmitType.MERGE_IF_NECESSARY);
-    project.setBooleanConfig(
-        BooleanProjectConfig.USE_CONTRIBUTOR_AGREEMENTS, InheritableBoolean.INHERIT);
-    project.setBooleanConfig(BooleanProjectConfig.USE_SIGNED_OFF_BY, InheritableBoolean.INHERIT);
-    project.setBooleanConfig(BooleanProjectConfig.USE_CONTENT_MERGE, InheritableBoolean.INHERIT);
-    project.setBooleanConfig(BooleanProjectConfig.REQUIRE_CHANGE_ID, InheritableBoolean.INHERIT);
+    projectConfig.updateProject(
+        b -> {
+          b.setParent(config.getBaseProject(getRepository().isPrivate()));
+          b.setDescription(description);
+          b.setSubmitType(SubmitType.MERGE_IF_NECESSARY);
+          b.setBooleanConfig(
+              BooleanProjectConfig.USE_CONTRIBUTOR_AGREEMENTS, InheritableBoolean.INHERIT);
+          b.setBooleanConfig(BooleanProjectConfig.USE_SIGNED_OFF_BY, InheritableBoolean.INHERIT);
+          b.setBooleanConfig(BooleanProjectConfig.USE_CONTENT_MERGE, InheritableBoolean.INHERIT);
+          b.setBooleanConfig(BooleanProjectConfig.REQUIRE_CHANGE_ID, InheritableBoolean.INHERIT);
+        });
   }
 
   @Override

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/GitImporter.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/GitImporter.java
index 0176091..ff81411 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/GitImporter.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/GitImporter.java

@@ -26,31 +26,48 @@
   public static class Provider extends HttpSessionProvider<GitImporter> {}
 
   private static final Logger log = LoggerFactory.getLogger(GitImporter.class);
+  private final ProtectedBranchesCheckStep.Factory protectedBranchesCheckFactory;
+  private final MagicRefCheckStep.Factory magicRefCheckFactory;
   private final GitCloneStep.Factory cloneFactory;
   private final CreateProjectStep.Factory projectFactory;
   private final ReplicateProjectStep.Factory replicateFactory;
 
   @Inject
   public GitImporter(
+      ProtectedBranchesCheckStep.Factory protectedBranchesCheckFactory,
       GitCloneStep.Factory cloneFactory,
       CreateProjectStep.Factory projectFactory,
       ReplicateProjectStep.Factory replicateFactory,
+      MagicRefCheckStep.Factory magicRefCheckFactory,
       JobExecutor executor,
       IdentifiedUser user) {
     super(executor, user);
+    this.protectedBranchesCheckFactory = protectedBranchesCheckFactory;
     this.cloneFactory = cloneFactory;
     this.projectFactory = projectFactory;
     this.replicateFactory = replicateFactory;
+    this.magicRefCheckFactory = magicRefCheckFactory;
   }
 
   public void clone(int idx, String organisation, String repository, String description) {
     try {
+      ProtectedBranchesCheckStep protectedBranchesCheckStep =
+          protectedBranchesCheckFactory.create(organisation, repository);
       GitCloneStep cloneStep = cloneFactory.create(organisation, repository);
+      MagicRefCheckStep magicRefCheckStep = magicRefCheckFactory.create(organisation, repository);
       CreateProjectStep projectStep =
           projectFactory.create(organisation, repository, description, user.getUserName().get());
       ReplicateProjectStep replicateStep = replicateFactory.create(organisation, repository);
       GitImportJob gitCloneJob =
-          new GitImportJob(idx, organisation, repository, cloneStep, projectStep, replicateStep);
+          new GitImportJob(
+              idx,
+              organisation,
+              repository,
+              protectedBranchesCheckStep,
+              magicRefCheckStep,
+              cloneStep,
+              projectStep,
+              replicateStep);
       log.debug("New Git clone job created: " + gitCloneJob);
       schedule(idx, gitCloneJob);
     } catch (Throwable e) {

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/MagicRefCheckStep.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/MagicRefCheckStep.java
new file mode 100644
index 0000000..616a31c
--- /dev/null
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/MagicRefCheckStep.java

@@ -0,0 +1,72 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.github.git;
+
+import com.google.common.base.Joiner;
+import com.google.common.collect.Lists;
+import com.google.gerrit.entities.RefNames;
+import com.google.gerrit.server.util.MagicBranch;
+import com.google.inject.Inject;
+import com.google.inject.assistedinject.Assisted;
+import com.googlesource.gerrit.plugins.github.GitHubConfig;
+import java.util.List;
+import org.eclipse.jgit.lib.ProgressMonitor;
+import org.kohsuke.github.GHRef;
+
+public class MagicRefCheckStep extends ImportStep {
+  public interface Factory {
+    MagicRefCheckStep create(
+        @Assisted("organisation") String organisation, @Assisted("name") String repository);
+  }
+
+  @Inject
+  public MagicRefCheckStep(
+      GitHubConfig config,
+      GitHubRepository.Factory gitHubRepoFactory,
+      @Assisted("organisation") String organisation,
+      @Assisted("name") String repository) {
+    super(config.gitHubUrl, organisation, repository, gitHubRepoFactory);
+  }
+
+  @Override
+  public void doImport(ProgressMonitor progress) throws Exception {
+    try {
+      GHRef[] allRefs = getRepository().getRefs();
+      progress.beginTask("Checking magic refs", allRefs.length);
+
+      List<String> offendingRefs = Lists.newLinkedList();
+      for (GHRef ref : allRefs) {
+        if (MagicBranch.isMagicBranch(ref.getRef())
+            || ref.getRef().startsWith(RefNames.REFS_META)) {
+          offendingRefs.add(ref.getRef());
+        }
+        progress.update(1);
+      }
+
+      if (!offendingRefs.isEmpty()) {
+        throw new MagicRefFoundException(
+            String.format(
+                "Found %d ref(s): Please remove or rename the following ref(s) and try again: %s",
+                offendingRefs.size(), Joiner.on(", ").join(offendingRefs)));
+      }
+    } finally {
+      progress.endTask();
+    }
+  }
+
+  @Override
+  public boolean rollback() {
+    return true;
+  }
+}

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/MagicRefFoundException.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/MagicRefFoundException.java
new file mode 100644
index 0000000..263ee9d
--- /dev/null
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/MagicRefFoundException.java

@@ -0,0 +1,26 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.github.git;
+
+public class MagicRefFoundException extends GitException {
+
+  public MagicRefFoundException(String message) {
+    super(message);
+  }
+
+  @Override
+  public String getErrorDescription() {
+    return String.format("Clash with Gerrit magic refs. %s", getMessage());
+  }
+}

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/ProtectedBranchFoundException.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/ProtectedBranchFoundException.java
new file mode 100644
index 0000000..221152f
--- /dev/null
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/ProtectedBranchFoundException.java

@@ -0,0 +1,22 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.github.git;
+
+public class ProtectedBranchFoundException extends Exception {
+
+  public ProtectedBranchFoundException(String msg) {
+    super(msg);
+  }
+}

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/ProtectedBranchesCheckStep.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/ProtectedBranchesCheckStep.java
new file mode 100644
index 0000000..5b2f763
--- /dev/null
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/git/ProtectedBranchesCheckStep.java

@@ -0,0 +1,67 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.github.git;
+
+import com.google.common.base.Joiner;
+import com.google.common.collect.Lists;
+import com.google.inject.Inject;
+import com.google.inject.assistedinject.Assisted;
+import com.googlesource.gerrit.plugins.github.GitHubConfig;
+import java.util.Collection;
+import java.util.List;
+import org.eclipse.jgit.lib.ProgressMonitor;
+import org.kohsuke.github.GHBranch;
+
+public class ProtectedBranchesCheckStep extends ImportStep {
+
+  public interface Factory {
+    ProtectedBranchesCheckStep create(
+        @Assisted("organisation") String organisation, @Assisted("name") String repository);
+  }
+
+  @Inject
+  public ProtectedBranchesCheckStep(
+      GitHubConfig config,
+      GitHubRepository.Factory gitHubRepoFactory,
+      @Assisted("organisation") String organisation,
+      @Assisted("name") String repository) {
+    super(config.gitHubUrl, organisation, repository, gitHubRepoFactory);
+  }
+
+  @Override
+  public void doImport(ProgressMonitor progress) throws Exception {
+    Collection<GHBranch> branches = getRepository().getBranches().values();
+    progress.beginTask("Checking branch protection", branches.size());
+    List<String> protectedBranchNames = Lists.newLinkedList();
+    for (GHBranch branch : branches) {
+      if (branch.isProtected()) {
+        protectedBranchNames.add(branch.getName());
+      }
+      progress.update(1);
+    }
+    progress.endTask();
+    if (!protectedBranchNames.isEmpty()) {
+      throw new ProtectedBranchFoundException(
+          String.format(
+              "Cannot import project with protected branches, you should remove protection from:%s",
+              Joiner.on(",").join(protectedBranchNames)));
+    }
+  }
+
+  @Override
+  public boolean rollback() {
+    return true;
+  }
+}

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubGroup.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubGroup.java
index 296a3f2..ba9581c 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubGroup.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubGroup.java

@@ -14,8 +14,8 @@
 
 package com.googlesource.gerrit.plugins.github.group;
 
-import com.google.gerrit.common.data.GroupDescription.Basic;
 import com.google.gerrit.entities.AccountGroup.UUID;
+import com.google.gerrit.entities.GroupDescription.Basic;
 import lombok.Getter;
 
 public abstract class GitHubGroup implements Basic {

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubGroupBackend.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubGroupBackend.java
index 1a6d0ac..21d6732 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubGroupBackend.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubGroupBackend.java

@@ -21,10 +21,10 @@
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSet.Builder;
-import com.google.gerrit.common.data.GroupDescription.Basic;
-import com.google.gerrit.common.data.GroupReference;
 import com.google.gerrit.entities.AccountGroup;
 import com.google.gerrit.entities.AccountGroup.UUID;
+import com.google.gerrit.entities.GroupDescription.Basic;
+import com.google.gerrit.entities.GroupReference;
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.GroupBackend;
 import com.google.gerrit.server.account.GroupMembership;

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubOrganisationGroup.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubOrganisationGroup.java
index e9c930c..604ecde 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubOrganisationGroup.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubOrganisationGroup.java

@@ -17,10 +17,10 @@
 import static com.google.common.base.Preconditions.checkArgument;
 
 import com.google.gerrit.common.Nullable;
-import com.google.gerrit.common.data.GroupDescription.Basic;
-import com.google.gerrit.common.data.GroupReference;
 import com.google.gerrit.entities.AccountGroup;
 import com.google.gerrit.entities.AccountGroup.UUID;
+import com.google.gerrit.entities.GroupDescription.Basic;
+import com.google.gerrit.entities.GroupReference;
 import com.google.inject.Inject;
 import com.google.inject.assistedinject.Assisted;
 
@@ -54,6 +54,6 @@
   }
 
   public static GroupReference groupReference(String orgName) {
-    return new GroupReference(uuid(orgName), NAME_PREFIX + orgName);
+    return GroupReference.create(uuid(orgName), NAME_PREFIX + orgName);
   }
 }

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubTeamGroup.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubTeamGroup.java
index ba0d3d3..022b407 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubTeamGroup.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/group/GitHubTeamGroup.java

@@ -15,9 +15,9 @@
 package com.googlesource.gerrit.plugins.github.group;
 
 import com.google.gerrit.common.Nullable;
-import com.google.gerrit.common.data.GroupReference;
 import com.google.gerrit.entities.AccountGroup;
 import com.google.gerrit.entities.AccountGroup.UUID;
+import com.google.gerrit.entities.GroupReference;
 import com.google.inject.Inject;
 import com.google.inject.assistedinject.Assisted;
 
@@ -52,7 +52,7 @@
   }
 
   public static GroupReference groupReference(GroupReference orgReference, String teamName) {
-    return new GroupReference(
+    return GroupReference.create(
         uuid(orgReference.getUUID(), teamName), orgReference.getName() + "/" + teamName);
   }
 }

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/replication/Destination.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/replication/Destination.java
index 29c7031..2e5528a 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/replication/Destination.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/replication/Destination.java

@@ -17,8 +17,8 @@
 import com.google.common.base.MoreObjects;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Lists;
-import com.google.gerrit.common.data.GroupReference;
 import com.google.gerrit.entities.AccountGroup;
+import com.google.gerrit.entities.GroupReference;
 import com.google.gerrit.entities.Project;
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.PluginUser;

diff --git a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/replication/RemoteSiteUser.java b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/replication/RemoteSiteUser.java
index f80af85..26def83 100644
--- a/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/replication/RemoteSiteUser.java
+++ b/github-plugin/src/main/java/com/googlesource/gerrit/plugins/github/replication/RemoteSiteUser.java

@@ -35,9 +35,4 @@
   public GroupMembership getEffectiveGroups() {
     return effectiveGroups;
   }
-
-  @Override
-  public Object getCacheKey() {
-    return effectiveGroups.getKnownGroups();
-  }
 }

diff --git a/pom.xml b/pom.xml
index 8a7aeab..742f42b 100644
--- a/pom.xml
+++ b/pom.xml

@@ -18,10 +18,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.googlesource.gerrit.plugins.github</groupId>
   <artifactId>github-parent</artifactId>
-  <version>3.2.1</version>
+  <version>3.3.0</version>
   <name>Gerrit Code Review - GitHub integration</name>
   <url>http://www.gerritforge.com</url>
   <packaging>pom</packaging>
+  <properties>
+    <javaVersion>11</javaVersion>
+  </properties>
   <licenses>
     <license>
       <name>Apache License, 2.0</name>
@@ -241,8 +244,8 @@
         <artifactId>maven-compiler-plugin</artifactId>
         <version>3.1</version>
         <configuration>
-          <source>1.8</source>
-          <target>1.8</target>
+          <source>${javaVersion}</source>
+          <target>${javaVersion}</target>
         </configuration>
       </plugin>
     </plugins>
@@ -289,7 +292,7 @@
     <dependency>
         <groupId>org.projectlombok</groupId>
         <artifactId>lombok</artifactId>
-        <version>1.16.2</version>
+        <version>1.18.16</version>
         <scope>provided</scope>
     </dependency>
   </dependencies>