From f72013331496eb0d8e301a7a23c602a892f38abb Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 8 Aug 2026 22:58:54 +1000 Subject: [PATCH] Protect default branches of unprotected active repos Why: - An audit for the new unkin-agent bot (org-wide write) found repos with no branch_protection at all, so the agent (or anyone with write) could push straight to their default branch. - The rest of the estate protects default branches; these repos were the gap. How: - Add enable_push: false + approval_whitelist_teams: Owners on each active repo's default branch, matching the estate's most common convention (PR-only; Owners can still open and approve). - Omit status checks on these repos as none run CI, so a required context would permanently block merges. - Leave the 8 archived repos untouched: they are read-only, nothing can push to them, and branch-protection creation on archived repos is rejected. --- .../unkin/repository/app-sudaporn-research-individual.yaml | 5 +++++ .../unkin/repository/app-sudaporn-research-normalised.yaml | 5 +++++ config/git.unkin.net/unkin/repository/benvin-utils.yaml | 5 +++++ .../git.unkin.net/unkin/repository/container-devcompute.yaml | 5 +++++ config/git.unkin.net/unkin/repository/docker-template.yaml | 5 +++++ config/git.unkin.net/unkin/repository/initbuilder.yaml | 5 +++++ config/git.unkin.net/unkin/repository/puppetapi.yaml | 5 +++++ .../unkin/repository/rpmbuild-internal-ca-certificates.yaml | 5 +++++ config/git.unkin.net/unkin/repository/streamstack.yaml | 5 +++++ 9 files changed, 45 insertions(+) diff --git a/config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml b/config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml index 73211ac..1fb51b3 100644 --- a/config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml +++ b/config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml @@ -2,3 +2,8 @@ description: "Sudaporn's Research Data visualisation, normalised " private: false default_branch: "master" default_delete_branch_after_merge: true +branch_protection: + - rule_name: "master" + enable_push: false + approval_whitelist_teams: + - "Owners" diff --git a/config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml b/config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml index f01e9b3..06756d6 100644 --- a/config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml +++ b/config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml @@ -2,3 +2,8 @@ description: "Sudaporn's Research Data visualisation, normalised" private: false default_branch: "master" default_delete_branch_after_merge: true +branch_protection: + - rule_name: "master" + enable_push: false + approval_whitelist_teams: + - "Owners" diff --git a/config/git.unkin.net/unkin/repository/benvin-utils.yaml b/config/git.unkin.net/unkin/repository/benvin-utils.yaml index 07bca1a..0e675b0 100644 --- a/config/git.unkin.net/unkin/repository/benvin-utils.yaml +++ b/config/git.unkin.net/unkin/repository/benvin-utils.yaml @@ -2,3 +2,8 @@ description: "Monorepo of small single-purpose CLI tools sharing a common librar private: false default_branch: "main" default_delete_branch_after_merge: true +branch_protection: + - rule_name: "main" + enable_push: false + approval_whitelist_teams: + - "Owners" diff --git a/config/git.unkin.net/unkin/repository/container-devcompute.yaml b/config/git.unkin.net/unkin/repository/container-devcompute.yaml index ef95f8e..ae1f26b 100644 --- a/config/git.unkin.net/unkin/repository/container-devcompute.yaml +++ b/config/git.unkin.net/unkin/repository/container-devcompute.yaml @@ -1,3 +1,8 @@ description: "Docker image to be used in Kubernetes as a developers container" private: false default_delete_branch_after_merge: true +branch_protection: + - rule_name: "main" + enable_push: false + approval_whitelist_teams: + - "Owners" diff --git a/config/git.unkin.net/unkin/repository/docker-template.yaml b/config/git.unkin.net/unkin/repository/docker-template.yaml index 42999f1..5b32a94 100644 --- a/config/git.unkin.net/unkin/repository/docker-template.yaml +++ b/config/git.unkin.net/unkin/repository/docker-template.yaml @@ -3,3 +3,8 @@ private: false default_branch: "master" default_delete_branch_after_merge: true repo_template: true +branch_protection: + - rule_name: "master" + enable_push: false + approval_whitelist_teams: + - "Owners" diff --git a/config/git.unkin.net/unkin/repository/initbuilder.yaml b/config/git.unkin.net/unkin/repository/initbuilder.yaml index 85bcc49..9a01f4f 100644 --- a/config/git.unkin.net/unkin/repository/initbuilder.yaml +++ b/config/git.unkin.net/unkin/repository/initbuilder.yaml @@ -1,3 +1,8 @@ description: "A repository for building initrd.img in docker " private: false default_delete_branch_after_merge: true +branch_protection: + - rule_name: "main" + enable_push: false + approval_whitelist_teams: + - "Owners" diff --git a/config/git.unkin.net/unkin/repository/puppetapi.yaml b/config/git.unkin.net/unkin/repository/puppetapi.yaml index be50ccc..bf2a61d 100644 --- a/config/git.unkin.net/unkin/repository/puppetapi.yaml +++ b/config/git.unkin.net/unkin/repository/puppetapi.yaml @@ -2,3 +2,8 @@ description: "A fastapi service to present puppet services via an api" private: false default_branch: "master" default_delete_branch_after_merge: true +branch_protection: + - rule_name: "master" + enable_push: false + approval_whitelist_teams: + - "Owners" diff --git a/config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml b/config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml index f2526d8..9ea46e5 100644 --- a/config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml +++ b/config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml @@ -2,3 +2,8 @@ description: "Package the internal ca-certificates" private: false default_branch: "master" default_delete_branch_after_merge: true +branch_protection: + - rule_name: "master" + enable_push: false + approval_whitelist_teams: + - "Owners" diff --git a/config/git.unkin.net/unkin/repository/streamstack.yaml b/config/git.unkin.net/unkin/repository/streamstack.yaml index fa9a000..02cb235 100644 --- a/config/git.unkin.net/unkin/repository/streamstack.yaml +++ b/config/git.unkin.net/unkin/repository/streamstack.yaml @@ -1,3 +1,8 @@ description: "A stack of microservices that aim to offer a distributed streaming service." private: false default_delete_branch_after_merge: true +branch_protection: + - rule_name: "main" + enable_push: false + approval_whitelist_teams: + - "Owners"