From 50673f371aa089b09ca534a6e817599985f1b657 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 17 Jul 2026 23:04:11 +1000
Subject: [PATCH 1/2] Add the openbao private fork repository

Create the Gitea repository for the private OpenBao fork so its integration
branch (main) can be pushed and hosted on git.unkin.net.

- Add config/git.unkin.net/unkin/repository/openbao.yaml (private, default branch
  main, delete branch after merge)
---
 config/git.unkin.net/unkin/repository/openbao.yaml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 config/git.unkin.net/unkin/repository/openbao.yaml

diff --git a/config/git.unkin.net/unkin/repository/openbao.yaml b/config/git.unkin.net/unkin/repository/openbao.yaml
new file mode 100644
index 0000000..8b1272c
--- /dev/null
+++ b/config/git.unkin.net/unkin/repository/openbao.yaml
@@ -0,0 +1,4 @@
+description: "Private fork of OpenBao adding per-namespace raft, cross-cluster performance replicas, virtual KV, and KV events"
+private: true
+default_branch: "main"
+default_delete_branch_after_merge: true

From b92235571ce2a9e976eb0d8b7599a43f2e320272 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 17 Jul 2026 23:32:23 +1000
Subject: [PATCH 2/2] Protect the openbao main branch

Add branch protection to the openbao fork repository so main is protected: only
the owner may push directly and other changes must land via a pull request that
passes the fork build pipeline.

- Add branch_protection for main (whitelist-push to the owner; require the
  ci/woodpecker/pr/build status check on PRs); set squash as the default merge
---
 config/git.unkin.net/unkin/repository/openbao.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/config/git.unkin.net/unkin/repository/openbao.yaml b/config/git.unkin.net/unkin/repository/openbao.yaml
index 8b1272c..767338b 100644
--- a/config/git.unkin.net/unkin/repository/openbao.yaml
+++ b/config/git.unkin.net/unkin/repository/openbao.yaml
@@ -2,3 +2,14 @@ description: "Private fork of OpenBao adding per-namespace raft, cross-cluster p
 private: true
 default_branch: "main"
 default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    # Whitelist-push: the owner can push main directly (needed for the initial
+    # push and the fork's maintenance workflow); everyone else must open a PR.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    # PRs to main must pass the fork build/vet pipeline before merge.
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"