diff --git a/deploy/README.md b/deploy/README.md index 326f2b8..557e1c1 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -31,6 +31,14 @@ out-of-band changes made in the GitHub UI. importability matrix and the push/tag/Actions-policy analysis. - `repository-rulesets/` — one `RepositoryRuleset` per file (`-on-.yaml`), each a repo-scoped rule adopted Observe-first. +- `repository-permissions/` — one `RepositoryPermissions` per managed repo enforcing + **Require actions to be pinned to a full-length commit SHA** + (`sha_pinning_required`). The policy is asserted once via a shared patch in + `repository-permissions/kustomization.yaml`; scope is every repo in `labels/` + **except `actions`**. Requires a provider-upjet-github release embedding + terraform-provider-github ≥ 6.11.0 (the field is absent in the deployed v0.19.1) + and activation of `repositorypermissions.actions.github.m.upbound.io` in the + platform MRAP. See the platform repo's [`docs/github-management.md`](https://github.com/devantler-tech/platform/blob/main/docs/github-management.md) diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml index 52afdfd..60e9d09 100644 --- a/deploy/kustomization.yaml +++ b/deploy/kustomization.yaml @@ -22,3 +22,4 @@ resources: - labels/ - organization-rulesets/ - repository-rulesets/ + - repository-permissions/ diff --git a/deploy/repository-permissions/agent-plugins.yaml b/deploy/repository-permissions/agent-plugins.yaml new file mode 100644 index 0000000..16819f3 --- /dev/null +++ b/deploy/repository-permissions/agent-plugins.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/agent-plugins — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: agent-plugins + annotations: + crossplane.io/external-name: agent-plugins +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: agent-plugins + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/agent-skills.yaml b/deploy/repository-permissions/agent-skills.yaml new file mode 100644 index 0000000..136e9f3 --- /dev/null +++ b/deploy/repository-permissions/agent-skills.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/agent-skills — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: agent-skills + annotations: + crossplane.io/external-name: agent-skills +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: agent-skills + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/ascoachingogvaner.yaml b/deploy/repository-permissions/ascoachingogvaner.yaml new file mode 100644 index 0000000..8013cc2 --- /dev/null +++ b/deploy/repository-permissions/ascoachingogvaner.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/ascoachingogvaner — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: ascoachingogvaner + annotations: + crossplane.io/external-name: ascoachingogvaner +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: ascoachingogvaner + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/dot-github.yaml b/deploy/repository-permissions/dot-github.yaml new file mode 100644 index 0000000..6750e85 --- /dev/null +++ b/deploy/repository-permissions/dot-github.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/.github — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: dot-github + annotations: + crossplane.io/external-name: .github +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: .github + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/dotnet-template.yaml b/deploy/repository-permissions/dotnet-template.yaml new file mode 100644 index 0000000..25d625a --- /dev/null +++ b/deploy/repository-permissions/dotnet-template.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/dotnet-template — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: dotnet-template + annotations: + crossplane.io/external-name: dotnet-template +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: dotnet-template + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/fleet-gitops.yaml b/deploy/repository-permissions/fleet-gitops.yaml new file mode 100644 index 0000000..74fa915 --- /dev/null +++ b/deploy/repository-permissions/fleet-gitops.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/fleet-gitops — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: fleet-gitops + annotations: + crossplane.io/external-name: fleet-gitops +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: fleet-gitops + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/gitops-tenant-template.yaml b/deploy/repository-permissions/gitops-tenant-template.yaml new file mode 100644 index 0000000..8119c83 --- /dev/null +++ b/deploy/repository-permissions/gitops-tenant-template.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/gitops-tenant-template — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: gitops-tenant-template + annotations: + crossplane.io/external-name: gitops-tenant-template +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: gitops-tenant-template + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/go-template.yaml b/deploy/repository-permissions/go-template.yaml new file mode 100644 index 0000000..88e4909 --- /dev/null +++ b/deploy/repository-permissions/go-template.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/go-template — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: go-template + annotations: + crossplane.io/external-name: go-template +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: go-template + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/homebrew-tap.yaml b/deploy/repository-permissions/homebrew-tap.yaml new file mode 100644 index 0000000..30a3fd6 --- /dev/null +++ b/deploy/repository-permissions/homebrew-tap.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/homebrew-tap — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: homebrew-tap + annotations: + crossplane.io/external-name: homebrew-tap +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: homebrew-tap + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/ksail.yaml b/deploy/repository-permissions/ksail.yaml new file mode 100644 index 0000000..e152e2d --- /dev/null +++ b/deploy/repository-permissions/ksail.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/ksail — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: ksail + annotations: + crossplane.io/external-name: ksail +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: ksail + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/kustomization.yaml b/deploy/repository-permissions/kustomization.yaml new file mode 100644 index 0000000..fc78a40 --- /dev/null +++ b/deploy/repository-permissions/kustomization.yaml @@ -0,0 +1,55 @@ +# Declarative "Require actions to be pinned to a full-length commit SHA" policy +# for the devantler-tech org — the GitHub Actions `sha_pinning_required` setting +# (GitHub, 2025-08) expressed as Crossplane `RepositoryPermissions` +# (provider-upjet-github, terraform `github_actions_repository_permissions`). +# +# One file per managed repo binds the policy to that repo; the shared patch below +# asserts `shaPinningRequired: true` ONCE (single source of truth) on every +# `RepositoryPermissions` — mirroring the org-wide patches in ../repositories/ and +# ../labels/. The resource is authoritative for SHA-pinning and reverts +# out-of-band changes; Observe + LateInitialize (in each resource) adopts the +# repo's live `enabled`/`allowedActions` first, so turning SHA-pinning on never +# disturbs them. +# +# Scope = every repo managed in ../labels/ EXCEPT `actions` +# (devantler-tech/actions is intentionally excluded). Bring a new repo under this +# policy by adding `.yaml` here. +# +# REQUIRES a provider-upjet-github release embedding terraform-provider-github +# >= 6.11.0 (where `sha_pinning_required` was added). The field is ABSENT in the +# currently-deployed v0.19.1 (which pins TF provider 6.6.0), so this directory +# must not be reconciled until that provider bump ships + the +# `repositorypermissions.actions.github.m.upbound.io` MRD is activated in the +# platform MRAP. Tracking: crossplane-contrib/provider-upjet-github#288. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - dot-github.yaml + - platform.yaml + - ksail.yaml + - maintenance.yaml + - agent-skills.yaml + - agent-plugins.yaml + - unifi.yaml + - gitops-tenant-template.yaml + - platform-template.yaml + - go-template.yaml + - dotnet-template.yaml + - homebrew-tap.yaml + - reusable-workflows.yaml + # Private repos. + - ascoachingogvaner.yaml + - wedding-app.yaml + - fleet-gitops.yaml +# Require every action to be pinned to a full-length commit SHA on each repo above +# (single source of truth). Org-wide — every repo added to this directory inherits +# it. Reusable workflows can still be referenced by tag (GitHub exempts them). +patches: + - target: + group: actions.github.m.upbound.io + version: v1alpha1 + kind: RepositoryPermissions + patch: |- + - op: add + path: /spec/forProvider/shaPinningRequired + value: true diff --git a/deploy/repository-permissions/maintenance.yaml b/deploy/repository-permissions/maintenance.yaml new file mode 100644 index 0000000..0215bbb --- /dev/null +++ b/deploy/repository-permissions/maintenance.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/maintenance — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: maintenance + annotations: + crossplane.io/external-name: maintenance +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: maintenance + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/platform-template.yaml b/deploy/repository-permissions/platform-template.yaml new file mode 100644 index 0000000..e6b34fd --- /dev/null +++ b/deploy/repository-permissions/platform-template.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/platform-template — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: platform-template + annotations: + crossplane.io/external-name: platform-template +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: platform-template + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/platform.yaml b/deploy/repository-permissions/platform.yaml new file mode 100644 index 0000000..760978a --- /dev/null +++ b/deploy/repository-permissions/platform.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/platform — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: platform + annotations: + crossplane.io/external-name: platform +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: platform + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/reusable-workflows.yaml b/deploy/repository-permissions/reusable-workflows.yaml new file mode 100644 index 0000000..c046b38 --- /dev/null +++ b/deploy/repository-permissions/reusable-workflows.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/reusable-workflows — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: reusable-workflows + annotations: + crossplane.io/external-name: reusable-workflows +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: reusable-workflows + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/unifi.yaml b/deploy/repository-permissions/unifi.yaml new file mode 100644 index 0000000..c0d7247 --- /dev/null +++ b/deploy/repository-permissions/unifi.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/unifi — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: unifi + annotations: + crossplane.io/external-name: unifi +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: unifi + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/repository-permissions/wedding-app.yaml b/deploy/repository-permissions/wedding-app.yaml new file mode 100644 index 0000000..7acb682 --- /dev/null +++ b/deploy/repository-permissions/wedding-app.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/wedding-app — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: wedding-app + annotations: + crossplane.io/external-name: wedding-app +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: wedding-app + providerConfigRef: + kind: ProviderConfig + name: default