# Service identity for repospawner, which opens pull requests against this
# repository (terraform-git) to add new Gitea repositories on request. It is
# deliberately separate from unkin-agent so its access can stay scoped to the
# single repository it needs: the "repospawner" team (unkin/team/repospawner.yaml)
# grants Write on terraform-git and nothing else.
#
# Auth is via ephemeral API tokens minted by the vault-plugin-secrets-gitea
# engine -- no usable credential lives in this repo's state beyond the generated
# placeholder. Merge stays blocked by branch protection (merge whitelist =
# Owners only), so it can push branches and open PRs but never merge.
email: repospawner@unkin.net
full_name: "Repo Spawner"
description: "repospawner service identity -- opens repo-creation PRs against terraform-git"
# Conservative bot posture: not a site admin, cannot create orgs or repos,
# profile visible only to signed-in users.
visibility: limited
admin: false
# Restricted: account can only see repos/orgs it is explicitly added to -- the
# repospawner team grant on terraform-git is all it needs.
restricted: true
allow_create_organization: false
max_repo_creation: 0