Add unkin-agent Gitea identity with write but no merge #59

2026-08-08T22:39:04+10:00

unkinben commented

2026-08-08 22:39:04 +10:00

Why: AI coding agents push and open PRs as Ben's own account with Ben's token, so their work is unattributable and runs with Ben's owner privileges. A dedicated least-privilege identity separates agent work from Ben's and keeps merge a human decision.

How:

add the unkin-agent bot user (non-admin, no org/repo creation, limited visibility); authenticates via ephemeral vault-plugin-secrets-gitea tokens, no stored password
add the agents team granting Write on all unkin repos (minimum to push branches + open PRs); unkin-agent is its only member
add merge_whitelist_teams Owners to every default-branch protection rule that lacked a merge whitelist, so Write no longer implies merge and only Owners (Ben) can merge

Note: 43 repos gained an Owners merge whitelist (zero change for Owners, who already merge). 17 repos have no branch protection at all — flagged separately; org-wide Write lets unkin-agent push directly to their default branch until they are gated.

Why: AI coding agents push and open PRs as Ben's own account with Ben's token, so their work is unattributable and runs with Ben's owner privileges. A dedicated least-privilege identity separates agent work from Ben's and keeps merge a human decision. How: - add the unkin-agent bot user (non-admin, no org/repo creation, limited visibility); authenticates via ephemeral vault-plugin-secrets-gitea tokens, no stored password - add the agents team granting Write on all unkin repos (minimum to push branches + open PRs); unkin-agent is its only member - add merge_whitelist_teams Owners to every default-branch protection rule that lacked a merge whitelist, so Write no longer implies merge and only Owners (Ben) can merge Note: 43 repos gained an Owners merge whitelist (zero change for Owners, who already merge). 17 repos have no branch protection at all — flagged separately; org-wide Write lets unkin-agent push directly to their default branch until they are gated.

unkinben added 1 commit 2026-08-08 22:39:04 +10:00

Add unkin-agent Gitea identity with write but no merge

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

4953142200

Why: AI coding agents currently push and open PRs as Ben's own account
using Ben's token, so their work is unattributable and carries Ben's full
owner privileges. A dedicated least-privilege identity separates agent work
from Ben's and keeps merge a human decision.

How:
- add the unkin-agent bot user (non-admin, no org/repo creation, limited
  visibility); it authenticates via ephemeral vault-plugin-secrets-gitea
  tokens, not a stored password
- add the agents team granting Write on all unkin repositories, the minimum
  needed to push branches and open PRs; unkin-agent is its only member
- add merge_whitelist_teams Owners to every default-branch protection rule
  that lacked a merge whitelist, so Write no longer implies merge and only
  Owners (Ben) can merge across the estate

benvin merged commit d7d6794a51 into main

2026-08-08 23:34:24 +10:00

benvin deleted branch benvin/unkin-agent-identity

2026-08-08 23:34:25 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-git#59