unkinben
4953142200
Why: AI coding agents currently push and open PRs as Ben's own account using Ben's token, so their work is unattributable and carries Ben's full owner privileges. A dedicated least-privilege identity separates agent work from Ben's and keeps merge a human decision. How: - add the unkin-agent bot user (non-admin, no org/repo creation, limited visibility); it authenticates via ephemeral vault-plugin-secrets-gitea tokens, not a stored password - add the agents team granting Write on all unkin repositories, the minimum needed to push branches and open PRs; unkin-agent is its only member - add merge_whitelist_teams Owners to every default-branch protection rule that lacked a merge whitelist, so Write no longer implies merge and only Owners (Ben) can merge across the estate
15 lines
663 B
YAML
15 lines
663 B
YAML
# Grants the unkin-agent bot Write across every unkin repository so Ben's AI
|
|
# coding agents can push benvin/* branches and open pull requests. Write is the
|
|
# minimum Gitea permission that allows pushing branches + creating PRs.
|
|
#
|
|
# Merge stays reserved for Ben: branch protection on every default branch sets a
|
|
# merge whitelist of the Owners team only, so members of this team can push and
|
|
# open PRs but cannot merge or approve. Keep this team out of every merge and
|
|
# approval whitelist.
|
|
description: "AI coding agents -- push branches + open PRs, never merge"
|
|
permission: write
|
|
include_all_repositories: true
|
|
can_create_repos: false
|
|
members:
|
|
- unkin-agent
|