From c82717d35b726e6e62978a937c1a5f419b5dfd63 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 24 Jun 2026 00:28:08 +0200 Subject: [PATCH 1/2] feat: require actions pinned to full-length commit SHA on all repos but actions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add deploy/actions-permissions/ — one RepositoryPermissions (actions.github.m.upbound.io, terraform github_actions_repository_permissions) per managed repo, asserting shaPinningRequired: true via a shared kustomize patch (single source of truth), mirroring the org-wide patches in repositories/ and labels/. Scope = every repo in labels/ EXCEPT devantler-tech/actions (intentionally excluded). Observe+LateInitialize adopts each repo's live enabled/allowedActions so enabling SHA-pinning never disturbs them. Requires a provider-upjet-github release embedding terraform-provider-github >= 6.11.0 (sha_pinning_required) and activation of repositorypermissions.actions.github.m.upbound.io in the platform MRAP. Co-Authored-By: Claude Opus 4.8 --- deploy/README.md | 8 +++ deploy/actions-permissions/agent-plugins.yaml | 21 +++++++ deploy/actions-permissions/agent-skills.yaml | 21 +++++++ .../ascoachingogvaner.yaml | 21 +++++++ deploy/actions-permissions/dot-github.yaml | 21 +++++++ .../actions-permissions/dotnet-template.yaml | 21 +++++++ deploy/actions-permissions/fleet-gitops.yaml | 21 +++++++ .../gitops-tenant-template.yaml | 21 +++++++ deploy/actions-permissions/go-template.yaml | 21 +++++++ deploy/actions-permissions/homebrew-tap.yaml | 21 +++++++ deploy/actions-permissions/ksail.yaml | 21 +++++++ deploy/actions-permissions/kustomization.yaml | 55 +++++++++++++++++++ deploy/actions-permissions/maintenance.yaml | 21 +++++++ .../platform-template.yaml | 21 +++++++ deploy/actions-permissions/platform.yaml | 21 +++++++ .../reusable-workflows.yaml | 21 +++++++ deploy/actions-permissions/unifi.yaml | 21 +++++++ deploy/actions-permissions/wedding-app.yaml | 21 +++++++ deploy/kustomization.yaml | 1 + 19 files changed, 400 insertions(+) create mode 100644 deploy/actions-permissions/agent-plugins.yaml create mode 100644 deploy/actions-permissions/agent-skills.yaml create mode 100644 deploy/actions-permissions/ascoachingogvaner.yaml create mode 100644 deploy/actions-permissions/dot-github.yaml create mode 100644 deploy/actions-permissions/dotnet-template.yaml create mode 100644 deploy/actions-permissions/fleet-gitops.yaml create mode 100644 deploy/actions-permissions/gitops-tenant-template.yaml create mode 100644 deploy/actions-permissions/go-template.yaml create mode 100644 deploy/actions-permissions/homebrew-tap.yaml create mode 100644 deploy/actions-permissions/ksail.yaml create mode 100644 deploy/actions-permissions/kustomization.yaml create mode 100644 deploy/actions-permissions/maintenance.yaml create mode 100644 deploy/actions-permissions/platform-template.yaml create mode 100644 deploy/actions-permissions/platform.yaml create mode 100644 deploy/actions-permissions/reusable-workflows.yaml create mode 100644 deploy/actions-permissions/unifi.yaml create mode 100644 deploy/actions-permissions/wedding-app.yaml diff --git a/deploy/README.md b/deploy/README.md index bfa9433..e57ae47 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -20,6 +20,14 @@ out-of-band changes made in the GitHub UI. every repo); each `.yaml` adds only that repo's Dependabot/Renovate ecosystem extras. Authoritative — out-of-band label drift is reverted. This is the Crossplane replacement for the old EndBug/label-sync workflow. +- `actions-permissions/` — one `RepositoryPermissions` per managed repo enforcing + **Require actions to be pinned to a full-length commit SHA** + (`sha_pinning_required`). The policy is asserted once via a shared patch in + `actions-permissions/kustomization.yaml`; scope is every repo in `labels/` + **except `actions`**. Requires a provider-upjet-github release embedding + terraform-provider-github ≥ 6.11.0 (the field is absent in the deployed v0.19.1) + and activation of `repositorypermissions.actions.github.m.upbound.io` in the + platform MRAP. See the platform repo's [`docs/github-management.md`](https://github.com/devantler-tech/platform/blob/main/docs/github-management.md) diff --git a/deploy/actions-permissions/agent-plugins.yaml b/deploy/actions-permissions/agent-plugins.yaml new file mode 100644 index 0000000..16819f3 --- /dev/null +++ b/deploy/actions-permissions/agent-plugins.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/agent-plugins — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: agent-plugins + annotations: + crossplane.io/external-name: agent-plugins +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: agent-plugins + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/agent-skills.yaml b/deploy/actions-permissions/agent-skills.yaml new file mode 100644 index 0000000..136e9f3 --- /dev/null +++ b/deploy/actions-permissions/agent-skills.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/agent-skills — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: agent-skills + annotations: + crossplane.io/external-name: agent-skills +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: agent-skills + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/ascoachingogvaner.yaml b/deploy/actions-permissions/ascoachingogvaner.yaml new file mode 100644 index 0000000..8013cc2 --- /dev/null +++ b/deploy/actions-permissions/ascoachingogvaner.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/ascoachingogvaner — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: ascoachingogvaner + annotations: + crossplane.io/external-name: ascoachingogvaner +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: ascoachingogvaner + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/dot-github.yaml b/deploy/actions-permissions/dot-github.yaml new file mode 100644 index 0000000..6750e85 --- /dev/null +++ b/deploy/actions-permissions/dot-github.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/.github — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: dot-github + annotations: + crossplane.io/external-name: .github +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: .github + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/dotnet-template.yaml b/deploy/actions-permissions/dotnet-template.yaml new file mode 100644 index 0000000..25d625a --- /dev/null +++ b/deploy/actions-permissions/dotnet-template.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/dotnet-template — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: dotnet-template + annotations: + crossplane.io/external-name: dotnet-template +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: dotnet-template + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/fleet-gitops.yaml b/deploy/actions-permissions/fleet-gitops.yaml new file mode 100644 index 0000000..74fa915 --- /dev/null +++ b/deploy/actions-permissions/fleet-gitops.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/fleet-gitops — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: fleet-gitops + annotations: + crossplane.io/external-name: fleet-gitops +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: fleet-gitops + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/gitops-tenant-template.yaml b/deploy/actions-permissions/gitops-tenant-template.yaml new file mode 100644 index 0000000..8119c83 --- /dev/null +++ b/deploy/actions-permissions/gitops-tenant-template.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/gitops-tenant-template — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: gitops-tenant-template + annotations: + crossplane.io/external-name: gitops-tenant-template +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: gitops-tenant-template + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/go-template.yaml b/deploy/actions-permissions/go-template.yaml new file mode 100644 index 0000000..88e4909 --- /dev/null +++ b/deploy/actions-permissions/go-template.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/go-template — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: go-template + annotations: + crossplane.io/external-name: go-template +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: go-template + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/homebrew-tap.yaml b/deploy/actions-permissions/homebrew-tap.yaml new file mode 100644 index 0000000..30a3fd6 --- /dev/null +++ b/deploy/actions-permissions/homebrew-tap.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/homebrew-tap — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: homebrew-tap + annotations: + crossplane.io/external-name: homebrew-tap +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: homebrew-tap + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/ksail.yaml b/deploy/actions-permissions/ksail.yaml new file mode 100644 index 0000000..e152e2d --- /dev/null +++ b/deploy/actions-permissions/ksail.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/ksail — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: ksail + annotations: + crossplane.io/external-name: ksail +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: ksail + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/kustomization.yaml b/deploy/actions-permissions/kustomization.yaml new file mode 100644 index 0000000..fc78a40 --- /dev/null +++ b/deploy/actions-permissions/kustomization.yaml @@ -0,0 +1,55 @@ +# Declarative "Require actions to be pinned to a full-length commit SHA" policy +# for the devantler-tech org — the GitHub Actions `sha_pinning_required` setting +# (GitHub, 2025-08) expressed as Crossplane `RepositoryPermissions` +# (provider-upjet-github, terraform `github_actions_repository_permissions`). +# +# One file per managed repo binds the policy to that repo; the shared patch below +# asserts `shaPinningRequired: true` ONCE (single source of truth) on every +# `RepositoryPermissions` — mirroring the org-wide patches in ../repositories/ and +# ../labels/. The resource is authoritative for SHA-pinning and reverts +# out-of-band changes; Observe + LateInitialize (in each resource) adopts the +# repo's live `enabled`/`allowedActions` first, so turning SHA-pinning on never +# disturbs them. +# +# Scope = every repo managed in ../labels/ EXCEPT `actions` +# (devantler-tech/actions is intentionally excluded). Bring a new repo under this +# policy by adding `.yaml` here. +# +# REQUIRES a provider-upjet-github release embedding terraform-provider-github +# >= 6.11.0 (where `sha_pinning_required` was added). The field is ABSENT in the +# currently-deployed v0.19.1 (which pins TF provider 6.6.0), so this directory +# must not be reconciled until that provider bump ships + the +# `repositorypermissions.actions.github.m.upbound.io` MRD is activated in the +# platform MRAP. Tracking: crossplane-contrib/provider-upjet-github#288. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - dot-github.yaml + - platform.yaml + - ksail.yaml + - maintenance.yaml + - agent-skills.yaml + - agent-plugins.yaml + - unifi.yaml + - gitops-tenant-template.yaml + - platform-template.yaml + - go-template.yaml + - dotnet-template.yaml + - homebrew-tap.yaml + - reusable-workflows.yaml + # Private repos. + - ascoachingogvaner.yaml + - wedding-app.yaml + - fleet-gitops.yaml +# Require every action to be pinned to a full-length commit SHA on each repo above +# (single source of truth). Org-wide — every repo added to this directory inherits +# it. Reusable workflows can still be referenced by tag (GitHub exempts them). +patches: + - target: + group: actions.github.m.upbound.io + version: v1alpha1 + kind: RepositoryPermissions + patch: |- + - op: add + path: /spec/forProvider/shaPinningRequired + value: true diff --git a/deploy/actions-permissions/maintenance.yaml b/deploy/actions-permissions/maintenance.yaml new file mode 100644 index 0000000..0215bbb --- /dev/null +++ b/deploy/actions-permissions/maintenance.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/maintenance — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: maintenance + annotations: + crossplane.io/external-name: maintenance +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: maintenance + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/platform-template.yaml b/deploy/actions-permissions/platform-template.yaml new file mode 100644 index 0000000..e6b34fd --- /dev/null +++ b/deploy/actions-permissions/platform-template.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/platform-template — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: platform-template + annotations: + crossplane.io/external-name: platform-template +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: platform-template + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/platform.yaml b/deploy/actions-permissions/platform.yaml new file mode 100644 index 0000000..760978a --- /dev/null +++ b/deploy/actions-permissions/platform.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/platform — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: platform + annotations: + crossplane.io/external-name: platform +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: platform + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/reusable-workflows.yaml b/deploy/actions-permissions/reusable-workflows.yaml new file mode 100644 index 0000000..c046b38 --- /dev/null +++ b/deploy/actions-permissions/reusable-workflows.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/reusable-workflows — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: reusable-workflows + annotations: + crossplane.io/external-name: reusable-workflows +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: reusable-workflows + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/unifi.yaml b/deploy/actions-permissions/unifi.yaml new file mode 100644 index 0000000..c0d7247 --- /dev/null +++ b/deploy/actions-permissions/unifi.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/unifi — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: unifi + annotations: + crossplane.io/external-name: unifi +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: unifi + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/actions-permissions/wedding-app.yaml b/deploy/actions-permissions/wedding-app.yaml new file mode 100644 index 0000000..7acb682 --- /dev/null +++ b/deploy/actions-permissions/wedding-app.yaml @@ -0,0 +1,21 @@ +# Actions permissions for devantler-tech/wedding-app — binds the org-wide +# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. +# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning +# on SHA-pinning never disturbs them. See ../README.md. +apiVersion: actions.github.m.upbound.io/v1alpha1 +kind: RepositoryPermissions +metadata: + name: wedding-app + annotations: + crossplane.io/external-name: wedding-app +spec: + managementPolicies: + - Observe + - Create + - Update + - LateInitialize + forProvider: + repository: wedding-app + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml index f5511ca..5449ca0 100644 --- a/deploy/kustomization.yaml +++ b/deploy/kustomization.yaml @@ -18,3 +18,4 @@ resources: - repositories/ - teams/ - labels/ + - actions-permissions/ From ebe8b71f3bd5a2b25453aebe7b436edc984ba3ac Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 25 Jun 2026 20:24:32 +0200 Subject: [PATCH 2/2] refactor(github): rename actions-permissions/ to repository-permissions/ (mirror CR kind) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The folder holds RepositoryPermissions resources, so name the subfolder after the CR kind — consistent with the per-CR-kind layout (repositories/, organization-rulesets/, repository-rulesets/, team-*/). Per-repo files keep the .yaml convention. Folder rename + reference updates (base kustomization, README) only; resource bodies unchanged. `kubectl kustomize deploy/` validated (16 RepositoryPermissions, SHA-pinning patch intact). Co-Authored-By: Claude Opus 4.8 --- deploy/README.md | 4 ++-- deploy/kustomization.yaml | 2 +- .../agent-plugins.yaml | 0 .../agent-skills.yaml | 0 .../ascoachingogvaner.yaml | 0 .../dot-github.yaml | 0 .../dotnet-template.yaml | 0 .../fleet-gitops.yaml | 0 .../gitops-tenant-template.yaml | 0 .../go-template.yaml | 0 .../homebrew-tap.yaml | 0 .../ksail.yaml | 0 .../kustomization.yaml | 0 .../maintenance.yaml | 0 .../platform-template.yaml | 0 .../platform.yaml | 0 .../reusable-workflows.yaml | 0 .../unifi.yaml | 0 .../wedding-app.yaml | 0 19 files changed, 3 insertions(+), 3 deletions(-) rename deploy/{actions-permissions => repository-permissions}/agent-plugins.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/agent-skills.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/ascoachingogvaner.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/dot-github.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/dotnet-template.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/fleet-gitops.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/gitops-tenant-template.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/go-template.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/homebrew-tap.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/ksail.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/kustomization.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/maintenance.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/platform-template.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/platform.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/reusable-workflows.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/unifi.yaml (100%) rename deploy/{actions-permissions => repository-permissions}/wedding-app.yaml (100%) diff --git a/deploy/README.md b/deploy/README.md index e57ae47..9a361b7 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -20,10 +20,10 @@ out-of-band changes made in the GitHub UI. every repo); each `.yaml` adds only that repo's Dependabot/Renovate ecosystem extras. Authoritative — out-of-band label drift is reverted. This is the Crossplane replacement for the old EndBug/label-sync workflow. -- `actions-permissions/` — one `RepositoryPermissions` per managed repo enforcing +- `repository-permissions/` — one `RepositoryPermissions` per managed repo enforcing **Require actions to be pinned to a full-length commit SHA** (`sha_pinning_required`). The policy is asserted once via a shared patch in - `actions-permissions/kustomization.yaml`; scope is every repo in `labels/` + `repository-permissions/kustomization.yaml`; scope is every repo in `labels/` **except `actions`**. Requires a provider-upjet-github release embedding terraform-provider-github ≥ 6.11.0 (the field is absent in the deployed v0.19.1) and activation of `repositorypermissions.actions.github.m.upbound.io` in the diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml index 5449ca0..47a21cc 100644 --- a/deploy/kustomization.yaml +++ b/deploy/kustomization.yaml @@ -18,4 +18,4 @@ resources: - repositories/ - teams/ - labels/ - - actions-permissions/ + - repository-permissions/ diff --git a/deploy/actions-permissions/agent-plugins.yaml b/deploy/repository-permissions/agent-plugins.yaml similarity index 100% rename from deploy/actions-permissions/agent-plugins.yaml rename to deploy/repository-permissions/agent-plugins.yaml diff --git a/deploy/actions-permissions/agent-skills.yaml b/deploy/repository-permissions/agent-skills.yaml similarity index 100% rename from deploy/actions-permissions/agent-skills.yaml rename to deploy/repository-permissions/agent-skills.yaml diff --git a/deploy/actions-permissions/ascoachingogvaner.yaml b/deploy/repository-permissions/ascoachingogvaner.yaml similarity index 100% rename from deploy/actions-permissions/ascoachingogvaner.yaml rename to deploy/repository-permissions/ascoachingogvaner.yaml diff --git a/deploy/actions-permissions/dot-github.yaml b/deploy/repository-permissions/dot-github.yaml similarity index 100% rename from deploy/actions-permissions/dot-github.yaml rename to deploy/repository-permissions/dot-github.yaml diff --git a/deploy/actions-permissions/dotnet-template.yaml b/deploy/repository-permissions/dotnet-template.yaml similarity index 100% rename from deploy/actions-permissions/dotnet-template.yaml rename to deploy/repository-permissions/dotnet-template.yaml diff --git a/deploy/actions-permissions/fleet-gitops.yaml b/deploy/repository-permissions/fleet-gitops.yaml similarity index 100% rename from deploy/actions-permissions/fleet-gitops.yaml rename to deploy/repository-permissions/fleet-gitops.yaml diff --git a/deploy/actions-permissions/gitops-tenant-template.yaml b/deploy/repository-permissions/gitops-tenant-template.yaml similarity index 100% rename from deploy/actions-permissions/gitops-tenant-template.yaml rename to deploy/repository-permissions/gitops-tenant-template.yaml diff --git a/deploy/actions-permissions/go-template.yaml b/deploy/repository-permissions/go-template.yaml similarity index 100% rename from deploy/actions-permissions/go-template.yaml rename to deploy/repository-permissions/go-template.yaml diff --git a/deploy/actions-permissions/homebrew-tap.yaml b/deploy/repository-permissions/homebrew-tap.yaml similarity index 100% rename from deploy/actions-permissions/homebrew-tap.yaml rename to deploy/repository-permissions/homebrew-tap.yaml diff --git a/deploy/actions-permissions/ksail.yaml b/deploy/repository-permissions/ksail.yaml similarity index 100% rename from deploy/actions-permissions/ksail.yaml rename to deploy/repository-permissions/ksail.yaml diff --git a/deploy/actions-permissions/kustomization.yaml b/deploy/repository-permissions/kustomization.yaml similarity index 100% rename from deploy/actions-permissions/kustomization.yaml rename to deploy/repository-permissions/kustomization.yaml diff --git a/deploy/actions-permissions/maintenance.yaml b/deploy/repository-permissions/maintenance.yaml similarity index 100% rename from deploy/actions-permissions/maintenance.yaml rename to deploy/repository-permissions/maintenance.yaml diff --git a/deploy/actions-permissions/platform-template.yaml b/deploy/repository-permissions/platform-template.yaml similarity index 100% rename from deploy/actions-permissions/platform-template.yaml rename to deploy/repository-permissions/platform-template.yaml diff --git a/deploy/actions-permissions/platform.yaml b/deploy/repository-permissions/platform.yaml similarity index 100% rename from deploy/actions-permissions/platform.yaml rename to deploy/repository-permissions/platform.yaml diff --git a/deploy/actions-permissions/reusable-workflows.yaml b/deploy/repository-permissions/reusable-workflows.yaml similarity index 100% rename from deploy/actions-permissions/reusable-workflows.yaml rename to deploy/repository-permissions/reusable-workflows.yaml diff --git a/deploy/actions-permissions/unifi.yaml b/deploy/repository-permissions/unifi.yaml similarity index 100% rename from deploy/actions-permissions/unifi.yaml rename to deploy/repository-permissions/unifi.yaml diff --git a/deploy/actions-permissions/wedding-app.yaml b/deploy/repository-permissions/wedding-app.yaml similarity index 100% rename from deploy/actions-permissions/wedding-app.yaml rename to deploy/repository-permissions/wedding-app.yaml