Merge pull request 'Add repospawner machine user scoped to terraform-git' (#88) from benvin/repospawner-user into main

Reviewed-on: #88
2026-08-30 09:34:47 +10:00
parent cb61d385e2 dd26c861fc
commit 2e9a5fb8d4
2 changed files with 38 additions and 0 deletions
@@ -0,0 +1,16 @@
+# Least-privilege access for the repospawner bot: Write on terraform-git only,
+# which is the minimum Gitea permission that allows pushing a branch and opening
+# a pull request. repospawner does its whole job here (repo-creation PRs), so it
+# is kept out of the org-wide "agents" team (include_all_repositories: true).
+#
+# Merge stays reserved for Ben: branch protection on terraform-git's main sets a
+# merge whitelist of the Owners team only. Keep this team out of every merge and
+# approval whitelist.
+description: "repospawner bot -- push branches + open PRs on terraform-git only"
+permission: write
+include_all_repositories: false
+can_create_repos: false
+repositories:
+  - terraform-git
+members:
+  - repospawner