unkin-agent
dd26c861fc
Defense in depth for the repo-creation bot: a restricted Gitea account can only see repositories and organisations it is explicitly added to, so a leaked repospawner token cannot enumerate or read the rest of the estate. The repospawner team grant on terraform-git already covers everything the bot does, so nothing it needs is lost.
23 lines
1.1 KiB
YAML
23 lines
1.1 KiB
YAML
# Service identity for repospawner, which opens pull requests against this
|
|
# repository (terraform-git) to add new Gitea repositories on request. It is
|
|
# deliberately separate from unkin-agent so its access can stay scoped to the
|
|
# single repository it needs: the "repospawner" team (unkin/team/repospawner.yaml)
|
|
# grants Write on terraform-git and nothing else.
|
|
#
|
|
# Auth is via ephemeral API tokens minted by the vault-plugin-secrets-gitea
|
|
# engine -- no usable credential lives in this repo's state beyond the generated
|
|
# placeholder. Merge stays blocked by branch protection (merge whitelist =
|
|
# Owners only), so it can push branches and open PRs but never merge.
|
|
email: repospawner@unkin.net
|
|
full_name: "Repo Spawner"
|
|
description: "repospawner service identity -- opens repo-creation PRs against terraform-git"
|
|
# Conservative bot posture: not a site admin, cannot create orgs or repos,
|
|
# profile visible only to signed-in users.
|
|
visibility: limited
|
|
admin: false
|
|
# Restricted: account can only see repos/orgs it is explicitly added to -- the
|
|
# repospawner team grant on terraform-git is all it needs.
|
|
restricted: true
|
|
allow_create_organization: false
|
|
max_repo_creation: 0
|