Protect tag creation by user?

I have 4 repos on GL that I am trying to set up a common CI and permissions. One of the things I’ve been working on recently is a CI job to public my packages when I tag them. To do this, I add a protected variable with the upload tokens. I both mask and protect those variables so they are only visible on protected branches. Then I go to each repo and protect all branch creation (i.e. * wildcard) so that only my user can create those tags.

What’s weird is that on 3 of the 4 repos, I can set “Allowed to create” to

  • Maintainers
  • Developers + Maintainers
  • No one


  • My user

But on one of the 4 repos, I don’t have the option to set tag creation to my user, only the three roles. I can’t figure out why that is. I’ve looked at all the settings and can’t find anything relevant. All four repos are owned by me, in my namespace.

The one difference I can think of is that the repo that I have this problem with was archived a few years back and I recently unarchived it to resurrect the project. Still, I can’t find any reason why this one repo won’t let me set tag creation to my user.