unkin/terraform-git
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

repospawner: mark the account restricted
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details

Browse Source 
Defense in depth for the repo-creation bot: a restricted Gitea account can
only see repositories and organisations it is explicitly added to, so a
leaked repospawner token cannot enumerate or read the rest of the estate.
The repospawner team grant on terraform-git already covers everything the
bot does, so nothing it needs is lost.
This commit is contained in:
Unkin Agent
2026-08-30 00:55:01 +10:00
parent 4b30ba0cfd
commit dd26c861fc
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/git.unkin.net/user/repospawner.yaml
+3
View File
@@ -15,5 +15,8 @@ description: "repospawner service identity -- opens repo-creation PRs against te
# profile visible only to signed-in users. # profile visible only to signed-in users.
visibility: limited visibility: limited
admin: false admin: false
# Restricted: account can only see repos/orgs it is explicitly added to -- the
# repospawner team grant on terraform-git is all it needs.
restricted: true
allow_create_organization: false allow_create_organization: false
max_repo_creation: 0 max_repo_creation: 0