Add repospawner machine user scoped to terraform-git #88

2026-08-30T00:48:34+10:00

unkin-agent commented

2026-08-30 00:48:34 +10:00

Why

The repospawner service opens repo-creation PRs against terraform-git and needs no other access. Giving it its own identity plus a per-repo team keeps it least-privilege — adding it to the existing agents team would grant write across every unkin repository (include_all_repositories: true).

How

config/git.unkin.net/user/repospawner.yaml — new machine user mirroring the unkin-agent bot posture: visibility: limited, admin: false, allow_create_organization: false, max_repo_creation: 0.
config/git.unkin.net/unkin/team/repospawner.yaml — new team with permission: write, include_all_repositories: false, repositories: [terraform-git], can_create_repos: false, members [repospawner].

No module changes needed: the team module already passes repositories through to gitea_team. Merge stays blocked by terraform-git's existing branch protection (merge whitelist = Owners), so repospawner can push branches and open PRs but never merge.

make pre-commit passes.

## Why The repospawner service opens repo-creation PRs against terraform-git and needs no other access. Giving it its own identity plus a per-repo team keeps it least-privilege — adding it to the existing `agents` team would grant write across every unkin repository (`include_all_repositories: true`). ## How - `config/git.unkin.net/user/repospawner.yaml` — new machine user mirroring the unkin-agent bot posture: `visibility: limited`, `admin: false`, `allow_create_organization: false`, `max_repo_creation: 0`. - `config/git.unkin.net/unkin/team/repospawner.yaml` — new team with `permission: write`, `include_all_repositories: false`, `repositories: [terraform-git]`, `can_create_repos: false`, members `[repospawner]`. No module changes needed: the team module already passes `repositories` through to `gitea_team`. Merge stays blocked by terraform-git's existing branch protection (merge whitelist = Owners), so repospawner can push branches and open PRs but never merge. `make pre-commit` passes.

unkin-agent added 1 commit 2026-08-30 00:48:34 +10:00

Add repospawner machine user scoped to terraform-git

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

4b30ba0cfd

repospawner opens repo-creation PRs against terraform-git and needs no other
access, so give it its own identity and a per-repo team instead of adding it to
the org-wide agents team.

- add config/git.unkin.net/user/repospawner.yaml (limited visibility, not admin,
  no org/repo creation), mirroring the unkin-agent bot posture
- add config/git.unkin.net/unkin/team/repospawner.yaml granting write on the
  terraform-git repository only (include_all_repositories false)

unkin-agent added 1 commit 2026-08-30 00:55:03 +10:00

repospawner: mark the account restricted

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

dd26c861fc

Defense in depth for the repo-creation bot: a restricted Gitea account can
only see repositories and organisations it is explicitly added to, so a
leaked repospawner token cannot enumerate or read the rest of the estate.
The repospawner team grant on terraform-git already covers everything the
bot does, so nothing it needs is lost.

unkin-agent commented

2026-08-30 00:55:07 +10:00

Hardening follow-up in dd26c86: set restricted: true on the repospawner account so a leaked token can only reach repos/orgs it is explicitly added to -- the repospawner team grant on terraform-git covers everything the bot does.

Hardening follow-up in dd26c86: set `restricted: true` on the repospawner account so a leaked token can only reach repos/orgs it is explicitly added to -- the repospawner team grant on terraform-git covers everything the bot does.

benvin merged commit 2e9a5fb8d4 into main

2026-08-30 09:34:47 +10:00

benvin deleted branch benvin/repospawner-user

2026-08-30 09:34:48 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-git#88