From 4953142200598e6ec537e199cb7d3f8b76e4e552 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 8 Aug 2026 22:37:52 +1000 Subject: [PATCH] Add unkin-agent Gitea identity with write but no merge Why: AI coding agents currently push and open PRs as Ben's own account using Ben's token, so their work is unattributable and carries Ben's full owner privileges. A dedicated least-privilege identity separates agent work from Ben's and keeps merge a human decision. How: - add the unkin-agent bot user (non-admin, no org/repo creation, limited visibility); it authenticates via ephemeral vault-plugin-secrets-gitea tokens, not a stored password - add the agents team granting Write on all unkin repositories, the minimum needed to push branches and open PRs; unkin-agent is its only member - add merge_whitelist_teams Owners to every default-branch protection rule that lacked a merge whitelist, so Write no longer implies merge and only Owners (Ben) can merge across the estate --- .../unkin/repository/argocd-apps.yaml | 2 ++ .../unkin/repository/artifactapi.yaml | 2 ++ .../unkin/repository/bind-operator.yaml | 2 ++ .../unkin/repository/bootapi-images.yaml | 2 ++ .../unkin/repository/bootapi-templates.yaml | 2 ++ .../unkin/repository/bootapi.yaml | 2 ++ .../unkin/repository/cephrgw-operator.yaml | 2 ++ .../unkin/repository/container-agent-base.yaml | 2 ++ .../unkin/repository/container-agent-dev.yaml | 2 ++ .../repository/container-agent-infra.yaml | 2 ++ .../unkin/repository/dns-updater.yaml | 2 ++ .../git.unkin.net/unkin/repository/encapi.yaml | 2 ++ .../unkin/repository/encapic.yaml | 2 ++ .../unkin/repository/jellyfin-ha.yaml | 2 ++ .../unkin/repository/kea-operator.yaml | 2 ++ .../unkin/repository/logarchiver.yaml | 2 ++ .../unkin/repository/node-lookup.yaml | 2 ++ .../unkin/repository/openbao.yaml | 2 ++ .../git.unkin.net/unkin/repository/passv.yaml | 2 ++ .../git.unkin.net/unkin/repository/pdbmux.yaml | 2 ++ .../git.unkin.net/unkin/repository/teabot.yaml | 2 ++ .../unkin/repository/terraform-git.yaml | 2 ++ .../unkin/repository/terraform-infra.yaml | 2 ++ .../terraform-provider-artifactapi.yaml | 2 ++ .../repository/terraform-provider-encapi.yaml | 2 ++ .../terraform-provider-giteavaultsecret.yaml | 2 ++ .../terraform-provider-gpgvaultsecret.yaml | 2 ++ .../repository/terraform-provider-kea.yaml | 2 ++ .../terraform-provider-litellmvaultsecret.yaml | 2 ++ .../terraform-provider-ranchervaultsecret.yaml | 2 ++ .../terraform-provider-tomswallapi.yaml | 2 ++ ...erraform-provider-vault-secrets-netbox.yaml | 2 ++ .../unkin/repository/terragrunt-enc.yaml | 2 ++ .../unkin/repository/tomswall.yaml | 2 ++ .../unkin/repository/tomswallapi.yaml | 2 ++ .../vault-plugin-secrets-apptoken.yaml | 2 ++ .../vault-plugin-secrets-bind-tsig.yaml | 2 ++ .../repository/vault-plugin-secrets-gitea.yaml | 2 ++ .../repository/vault-plugin-secrets-gpg.yaml | 2 ++ .../vault-plugin-secrets-litellm.yaml | 2 ++ .../vault-plugin-secrets-netbox.yaml | 2 ++ .../vault-plugin-secrets-rancher.yaml | 2 ++ .../unkin/repository/vault-tools.yaml | 2 ++ config/git.unkin.net/unkin/team/agents.yaml | 14 ++++++++++++++ config/git.unkin.net/user/unkin-agent.yaml | 18 ++++++++++++++++++ 45 files changed, 118 insertions(+) create mode 100644 config/git.unkin.net/unkin/team/agents.yaml create mode 100644 config/git.unkin.net/user/unkin-agent.yaml diff --git a/config/git.unkin.net/unkin/repository/argocd-apps.yaml b/config/git.unkin.net/unkin/repository/argocd-apps.yaml index 87acc5a..4e3f06d 100644 --- a/config/git.unkin.net/unkin/repository/argocd-apps.yaml +++ b/config/git.unkin.net/unkin/repository/argocd-apps.yaml @@ -4,6 +4,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/artifactapi.yaml b/config/git.unkin.net/unkin/repository/artifactapi.yaml index 53404e2..07e444e 100644 --- a/config/git.unkin.net/unkin/repository/artifactapi.yaml +++ b/config/git.unkin.net/unkin/repository/artifactapi.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "master" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/bind-operator.yaml b/config/git.unkin.net/unkin/repository/bind-operator.yaml index 3c9e224..ba30b43 100644 --- a/config/git.unkin.net/unkin/repository/bind-operator.yaml +++ b/config/git.unkin.net/unkin/repository/bind-operator.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/bootapi-images.yaml b/config/git.unkin.net/unkin/repository/bootapi-images.yaml index d82dcdd..995a1dd 100644 --- a/config/git.unkin.net/unkin/repository/bootapi-images.yaml +++ b/config/git.unkin.net/unkin/repository/bootapi-images.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/bootapi-templates.yaml b/config/git.unkin.net/unkin/repository/bootapi-templates.yaml index 20f5ec6..1bed087 100644 --- a/config/git.unkin.net/unkin/repository/bootapi-templates.yaml +++ b/config/git.unkin.net/unkin/repository/bootapi-templates.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/bootapi.yaml b/config/git.unkin.net/unkin/repository/bootapi.yaml index f8f88fa..7bb793a 100644 --- a/config/git.unkin.net/unkin/repository/bootapi.yaml +++ b/config/git.unkin.net/unkin/repository/bootapi.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/cephrgw-operator.yaml b/config/git.unkin.net/unkin/repository/cephrgw-operator.yaml index 383b530..9845047 100644 --- a/config/git.unkin.net/unkin/repository/cephrgw-operator.yaml +++ b/config/git.unkin.net/unkin/repository/cephrgw-operator.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/container-agent-base.yaml b/config/git.unkin.net/unkin/repository/container-agent-base.yaml index 8d242f6..682bca9 100644 --- a/config/git.unkin.net/unkin/repository/container-agent-base.yaml +++ b/config/git.unkin.net/unkin/repository/container-agent-base.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/container-agent-dev.yaml b/config/git.unkin.net/unkin/repository/container-agent-dev.yaml index 0586779..2ca6ab4 100644 --- a/config/git.unkin.net/unkin/repository/container-agent-dev.yaml +++ b/config/git.unkin.net/unkin/repository/container-agent-dev.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/container-agent-infra.yaml b/config/git.unkin.net/unkin/repository/container-agent-infra.yaml index 616df38..4445258 100644 --- a/config/git.unkin.net/unkin/repository/container-agent-infra.yaml +++ b/config/git.unkin.net/unkin/repository/container-agent-infra.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/dns-updater.yaml b/config/git.unkin.net/unkin/repository/dns-updater.yaml index cf369c0..73870a2 100644 --- a/config/git.unkin.net/unkin/repository/dns-updater.yaml +++ b/config/git.unkin.net/unkin/repository/dns-updater.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/encapi.yaml b/config/git.unkin.net/unkin/repository/encapi.yaml index 62781b3..0485913 100644 --- a/config/git.unkin.net/unkin/repository/encapi.yaml +++ b/config/git.unkin.net/unkin/repository/encapi.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/encapic.yaml b/config/git.unkin.net/unkin/repository/encapic.yaml index b8e6fbc..ebeec21 100644 --- a/config/git.unkin.net/unkin/repository/encapic.yaml +++ b/config/git.unkin.net/unkin/repository/encapic.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/jellyfin-ha.yaml b/config/git.unkin.net/unkin/repository/jellyfin-ha.yaml index 06ad800..34c098e 100644 --- a/config/git.unkin.net/unkin/repository/jellyfin-ha.yaml +++ b/config/git.unkin.net/unkin/repository/jellyfin-ha.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/kea-operator.yaml b/config/git.unkin.net/unkin/repository/kea-operator.yaml index 56861fc..e63a5cb 100644 --- a/config/git.unkin.net/unkin/repository/kea-operator.yaml +++ b/config/git.unkin.net/unkin/repository/kea-operator.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/logarchiver.yaml b/config/git.unkin.net/unkin/repository/logarchiver.yaml index fb0245e..0402f94 100644 --- a/config/git.unkin.net/unkin/repository/logarchiver.yaml +++ b/config/git.unkin.net/unkin/repository/logarchiver.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/node-lookup.yaml b/config/git.unkin.net/unkin/repository/node-lookup.yaml index 3afff57..3197c61 100644 --- a/config/git.unkin.net/unkin/repository/node-lookup.yaml +++ b/config/git.unkin.net/unkin/repository/node-lookup.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/openbao.yaml b/config/git.unkin.net/unkin/repository/openbao.yaml index 767338b..5edd4ca 100644 --- a/config/git.unkin.net/unkin/repository/openbao.yaml +++ b/config/git.unkin.net/unkin/repository/openbao.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" # Whitelist-push: the owner can push main directly (needed for the initial # push and the fork's maintenance workflow); everyone else must open a PR. enable_push: true diff --git a/config/git.unkin.net/unkin/repository/passv.yaml b/config/git.unkin.net/unkin/repository/passv.yaml index be30896..c16b071 100644 --- a/config/git.unkin.net/unkin/repository/passv.yaml +++ b/config/git.unkin.net/unkin/repository/passv.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/pdbmux.yaml b/config/git.unkin.net/unkin/repository/pdbmux.yaml index d06b7e9..896e189 100644 --- a/config/git.unkin.net/unkin/repository/pdbmux.yaml +++ b/config/git.unkin.net/unkin/repository/pdbmux.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/teabot.yaml b/config/git.unkin.net/unkin/repository/teabot.yaml index 1f41d08..df8b4f0 100644 --- a/config/git.unkin.net/unkin/repository/teabot.yaml +++ b/config/git.unkin.net/unkin/repository/teabot.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/repository/terraform-git.yaml b/config/git.unkin.net/unkin/repository/terraform-git.yaml index 9492071..8fcfe03 100644 --- a/config/git.unkin.net/unkin/repository/terraform-git.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-git.yaml @@ -4,6 +4,8 @@ default_branch: "main" default_delete_branch_after_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-infra.yaml b/config/git.unkin.net/unkin/repository/terraform-infra.yaml index d9bc647..255c6ed 100644 --- a/config/git.unkin.net/unkin/repository/terraform-infra.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-infra.yaml @@ -4,6 +4,8 @@ default_branch: "main" default_delete_branch_after_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-artifactapi.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-artifactapi.yaml index 7fc3cce..d8f1fb4 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-artifactapi.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-artifactapi.yaml @@ -3,6 +3,8 @@ private: false default_delete_branch_after_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-encapi.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-encapi.yaml index ba00597..13f3bf3 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-encapi.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-encapi.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-giteavaultsecret.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-giteavaultsecret.yaml index e667fae..f0fac71 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-giteavaultsecret.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-giteavaultsecret.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml index 054f468..bc81928 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-kea.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-kea.yaml index 1ac4b9f..d44a26a 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-kea.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-kea.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-litellmvaultsecret.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-litellmvaultsecret.yaml index a20c2ed..c16652b 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-litellmvaultsecret.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-litellmvaultsecret.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml index fd87063..5b7e5f0 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-tomswallapi.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-tomswallapi.yaml index 0901e02..3c55090 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-tomswallapi.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-tomswallapi.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-netbox.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-netbox.yaml index 73ba41d..63ff875 100644 --- a/config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-netbox.yaml +++ b/config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-netbox.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/terragrunt-enc.yaml b/config/git.unkin.net/unkin/repository/terragrunt-enc.yaml index 157d491..240a39d 100644 --- a/config/git.unkin.net/unkin/repository/terragrunt-enc.yaml +++ b/config/git.unkin.net/unkin/repository/terragrunt-enc.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/tomswall.yaml b/config/git.unkin.net/unkin/repository/tomswall.yaml index 34e9611..41a1e1d 100644 --- a/config/git.unkin.net/unkin/repository/tomswall.yaml +++ b/config/git.unkin.net/unkin/repository/tomswall.yaml @@ -5,4 +5,6 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false diff --git a/config/git.unkin.net/unkin/repository/tomswallapi.yaml b/config/git.unkin.net/unkin/repository/tomswallapi.yaml index 717206a..cc58af7 100644 --- a/config/git.unkin.net/unkin/repository/tomswallapi.yaml +++ b/config/git.unkin.net/unkin/repository/tomswallapi.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-apptoken.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-apptoken.yaml index a02b0ac..56cc968 100644 --- a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-apptoken.yaml +++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-apptoken.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-bind-tsig.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-bind-tsig.yaml index cfb9b6d..dc8f5b4 100644 --- a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-bind-tsig.yaml +++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-bind-tsig.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-gitea.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-gitea.yaml index 5773346..c377580 100644 --- a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-gitea.yaml +++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-gitea.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml index 1de8764..a84ec6b 100644 --- a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml +++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-litellm.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-litellm.yaml index d859cb6..6cd465c 100644 --- a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-litellm.yaml +++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-litellm.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-netbox.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-netbox.yaml index ab83ca1..89d67e6 100644 --- a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-netbox.yaml +++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-netbox.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml index 8d37163..b6b32fc 100644 --- a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml +++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml @@ -10,6 +10,8 @@ allow_rebase_explicit: false allow_squash_merge: true branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/pre-commit" diff --git a/config/git.unkin.net/unkin/repository/vault-tools.yaml b/config/git.unkin.net/unkin/repository/vault-tools.yaml index 396f2d6..1ab8c35 100644 --- a/config/git.unkin.net/unkin/repository/vault-tools.yaml +++ b/config/git.unkin.net/unkin/repository/vault-tools.yaml @@ -5,6 +5,8 @@ default_delete_branch_after_merge: true default_merge_style: "squash" branch_protection: - rule_name: "main" + merge_whitelist_teams: + - "Owners" enable_push: false status_check_contexts: - "ci/woodpecker/pr/build" diff --git a/config/git.unkin.net/unkin/team/agents.yaml b/config/git.unkin.net/unkin/team/agents.yaml new file mode 100644 index 0000000..4bd44f3 --- /dev/null +++ b/config/git.unkin.net/unkin/team/agents.yaml @@ -0,0 +1,14 @@ +# Grants the unkin-agent bot Write across every unkin repository so Ben's AI +# coding agents can push benvin/* branches and open pull requests. Write is the +# minimum Gitea permission that allows pushing branches + creating PRs. +# +# Merge stays reserved for Ben: branch protection on every default branch sets a +# merge whitelist of the Owners team only, so members of this team can push and +# open PRs but cannot merge or approve. Keep this team out of every merge and +# approval whitelist. +description: "AI coding agents -- push branches + open PRs, never merge" +permission: write +include_all_repositories: true +can_create_repos: false +members: + - unkin-agent diff --git a/config/git.unkin.net/user/unkin-agent.yaml b/config/git.unkin.net/user/unkin-agent.yaml new file mode 100644 index 0000000..ef96a0e --- /dev/null +++ b/config/git.unkin.net/user/unkin-agent.yaml @@ -0,0 +1,18 @@ +# Shared identity used by Ben's AI coding agents to submit work (branches, pull +# requests, issues, comments) as a distinct, attributable, least-privilege +# account instead of Ben's own login. Auth is via ephemeral API tokens minted by +# the vault-plugin-secrets-gitea engine (gitea/creds/unkin-agent) -- no token or +# usable password lives in this repo's state beyond the generated placeholder. +# +# Write access comes from the "agents" team (team/agents.yaml); merge is blocked +# by branch protection (merge whitelist = Owners only), so the agent can open and +# comment on PRs/issues but never merge or approve. +email: unkin-agent@unkin.net +full_name: "Unkin Agent" +description: "shared identity for automated AI coding agents -- write, never merge" +# Conservative bot posture: not a site admin, cannot create orgs or repos, +# profile visible only to signed-in users. +visibility: limited +admin: false +allow_create_organization: false +max_repo_creation: 0