feat: require actions pinned to a full-length commit SHA on all repos but actions

deploy/README.md

@@ -31,6 +31,14 @@ out-of-band changes made in the GitHub UI.
   importability matrix and the push/tag/Actions-policy analysis.
 - `repository-rulesets/` — one `RepositoryRuleset` per file (`<verb>-on-<repo>.yaml`),
   each a repo-scoped rule adopted Observe-first.
+- `repository-permissions/` — one `RepositoryPermissions` per managed repo enforcing
+  **Require actions to be pinned to a full-length commit SHA**
+  (`sha_pinning_required`). The policy is asserted once via a shared patch in
+  `repository-permissions/kustomization.yaml`; scope is every repo in `labels/`
+  **except `actions`**. Requires a provider-upjet-github release embedding
+  terraform-provider-github ≥ 6.11.0 (the field is absent in the deployed v0.19.1)
+  and activation of `repositorypermissions.actions.github.m.upbound.io` in the
+  platform MRAP.
 
 See the platform repo's
 [`docs/github-management.md`](https://github.com/devantler-tech/platform/blob/main/docs/github-management.md)

deploy/kustomization.yaml

@@ -22,3 +22,4 @@ resources:
   - labels/
   - organization-rulesets/
   - repository-rulesets/
+  - repository-permissions/

deploy/repository-permissions/agent-plugins.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/agent-plugins — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: agent-plugins
+  annotations:
+    crossplane.io/external-name: agent-plugins
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: agent-plugins
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/agent-skills.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/agent-skills — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: agent-skills
+  annotations:
+    crossplane.io/external-name: agent-skills
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: agent-skills
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/ascoachingogvaner.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/ascoachingogvaner — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: ascoachingogvaner
+  annotations:
+    crossplane.io/external-name: ascoachingogvaner
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: ascoachingogvaner
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/dot-github.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/.github — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: dot-github
+  annotations:
+    crossplane.io/external-name: .github
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: .github
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/dotnet-template.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/dotnet-template — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: dotnet-template
+  annotations:
+    crossplane.io/external-name: dotnet-template
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: dotnet-template
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/fleet-gitops.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/fleet-gitops — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: fleet-gitops
+  annotations:
+    crossplane.io/external-name: fleet-gitops
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: fleet-gitops
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/gitops-tenant-template.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/gitops-tenant-template — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: gitops-tenant-template
+  annotations:
+    crossplane.io/external-name: gitops-tenant-template
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: gitops-tenant-template
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/go-template.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/go-template — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: go-template
+  annotations:
+    crossplane.io/external-name: go-template
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: go-template
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/homebrew-tap.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/homebrew-tap — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: homebrew-tap
+  annotations:
+    crossplane.io/external-name: homebrew-tap
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: homebrew-tap
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/ksail.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/ksail — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: ksail
+  annotations:
+    crossplane.io/external-name: ksail
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: ksail
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/kustomization.yaml

@@ -0,0 +1,55 @@
+# Declarative "Require actions to be pinned to a full-length commit SHA" policy
+# for the devantler-tech org — the GitHub Actions `sha_pinning_required` setting
+# (GitHub, 2025-08) expressed as Crossplane `RepositoryPermissions`
+# (provider-upjet-github, terraform `github_actions_repository_permissions`).
+#
+# One file per managed repo binds the policy to that repo; the shared patch below
+# asserts `shaPinningRequired: true` ONCE (single source of truth) on every
+# `RepositoryPermissions` — mirroring the org-wide patches in ../repositories/ and
+# ../labels/. The resource is authoritative for SHA-pinning and reverts
+# out-of-band changes; Observe + LateInitialize (in each resource) adopts the
+# repo's live `enabled`/`allowedActions` first, so turning SHA-pinning on never
+# disturbs them.
+#
+# Scope = every repo managed in ../labels/ EXCEPT `actions`
+# (devantler-tech/actions is intentionally excluded). Bring a new repo under this
+# policy by adding `<repo>.yaml` here.
+#
+# REQUIRES a provider-upjet-github release embedding terraform-provider-github
+# >= 6.11.0 (where `sha_pinning_required` was added). The field is ABSENT in the
+# currently-deployed v0.19.1 (which pins TF provider 6.6.0), so this directory
+# must not be reconciled until that provider bump ships + the
+# `repositorypermissions.actions.github.m.upbound.io` MRD is activated in the
+# platform MRAP. Tracking: crossplane-contrib/provider-upjet-github#288.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - dot-github.yaml
+  - platform.yaml
+  - ksail.yaml
+  - maintenance.yaml
+  - agent-skills.yaml
+  - agent-plugins.yaml
+  - unifi.yaml
+  - gitops-tenant-template.yaml
+  - platform-template.yaml
+  - go-template.yaml
+  - dotnet-template.yaml
+  - homebrew-tap.yaml
+  - reusable-workflows.yaml
+  # Private repos.
+  - ascoachingogvaner.yaml
+  - wedding-app.yaml
+  - fleet-gitops.yaml
+# Require every action to be pinned to a full-length commit SHA on each repo above
+# (single source of truth). Org-wide — every repo added to this directory inherits
+# it. Reusable workflows can still be referenced by tag (GitHub exempts them).
+patches:
+  - target:
+      group: actions.github.m.upbound.io
+      version: v1alpha1
+      kind: RepositoryPermissions
+    patch: |-
+      - op: add
+        path: /spec/forProvider/shaPinningRequired
+        value: true

deploy/repository-permissions/maintenance.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/maintenance — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: maintenance
+  annotations:
+    crossplane.io/external-name: maintenance
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: maintenance
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/platform-template.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/platform-template — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: platform-template
+  annotations:
+    crossplane.io/external-name: platform-template
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: platform-template
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/platform.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/platform — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: platform
+  annotations:
+    crossplane.io/external-name: platform
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: platform
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/reusable-workflows.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/reusable-workflows — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: reusable-workflows
+  annotations:
+    crossplane.io/external-name: reusable-workflows
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: reusable-workflows
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default