From dd26c861fc3399cfc94e6b21ce5cfed1be222beb Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 30 Aug 2026 00:55:01 +1000 Subject: [PATCH] repospawner: mark the account restricted Defense in depth for the repo-creation bot: a restricted Gitea account can only see repositories and organisations it is explicitly added to, so a leaked repospawner token cannot enumerate or read the rest of the estate. The repospawner team grant on terraform-git already covers everything the bot does, so nothing it needs is lost. --- config/git.unkin.net/user/repospawner.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/git.unkin.net/user/repospawner.yaml b/config/git.unkin.net/user/repospawner.yaml index 8bea574..9cc0c39 100644 --- a/config/git.unkin.net/user/repospawner.yaml +++ b/config/git.unkin.net/user/repospawner.yaml @@ -15,5 +15,8 @@ description: "repospawner service identity -- opens repo-creation PRs against te # profile visible only to signed-in users. visibility: limited admin: false +# Restricted: account can only see repos/orgs it is explicitly added to -- the +# repospawner team grant on terraform-git is all it needs. +restricted: true allow_create_organization: false max_repo_creation: 0