From d511d3c3e3504a688bf1e4b1ac3410995fa47a1a Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 24 Jun 2026 00:28:04 +0200 Subject: [PATCH] feat: activate RepositoryPermissions MRD for actions SHA-pinning Activate repositorypermissions.actions.github.m.upbound.io in the github-config MRAP so the org's "Require actions to be pinned to a full-length commit SHA" policy can be reconciled declaratively from devantler-tech/.github deploy/actions-permissions/. The github-config tenant Role already grants the actions.github.m.upbound.io group, so no RBAC change is needed. Gated on a provider-upjet-github release embedding terraform-provider-github >= 6.11.0 (sha_pinning_required); absent in the deployed v0.19.1 (TF 6.6.0). Co-Authored-By: Claude Opus 4.8 --- .../crossplane/managed-resource-activation-policy.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml index 9700f4eb1..3107479a3 100644 --- a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml +++ b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml @@ -31,3 +31,11 @@ spec: - teams.team.github.m.upbound.io - teammemberships.team.github.m.upbound.io - teamrepositories.team.github.m.upbound.io + # Actions repository permissions — the per-repo "Require actions to be pinned + # to a full-length commit SHA" policy (sha_pinning_required), declared in + # devantler-tech/.github deploy/actions-permissions/ for every managed repo + # except `actions`. The tenant Role already covers the + # actions.github.m.upbound.io group. REQUIRES a provider-upjet-github release + # embedding terraform-provider-github >= 6.11.0 (where sha_pinning_required + # landed) — absent in the currently-deployed v0.19.1 (TF 6.6.0). + - repositorypermissions.actions.github.m.upbound.io