unkinben
4953142200
Why: AI coding agents currently push and open PRs as Ben's own account using Ben's token, so their work is unattributable and carries Ben's full owner privileges. A dedicated least-privilege identity separates agent work from Ben's and keeps merge a human decision. How: - add the unkin-agent bot user (non-admin, no org/repo creation, limited visibility); it authenticates via ephemeral vault-plugin-secrets-gitea tokens, not a stored password - add the agents team granting Write on all unkin repositories, the minimum needed to push branches and open PRs; unkin-agent is its only member - add merge_whitelist_teams Owners to every default-branch protection rule that lacked a merge whitelist, so Write no longer implies merge and only Owners (Ben) can merge across the estate
22 lines
733 B
YAML
22 lines
733 B
YAML
description: "HashiCorp Vault / OpenBao secrets engine for NetBox API tokens (seeded admin + dynamic per-user tokens with expiry-aligned leases)"
|
|
private: false
|
|
default_branch: "main"
|
|
default_delete_branch_after_merge: true
|
|
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
# the allowed styles to squash to force it.
|
|
allow_merge_commits: false
|
|
allow_rebase: false
|
|
allow_rebase_explicit: false
|
|
allow_squash_merge: true
|
|
branch_protection:
|
|
- rule_name: "main"
|
|
merge_whitelist_teams:
|
|
- "Owners"
|
|
enable_push: false
|
|
status_check_contexts:
|
|
- "ci/woodpecker/pr/pre-commit"
|
|
- "ci/woodpecker/pr/build"
|
|
- "ci/woodpecker/pr/test"
|
|
approval_whitelist_teams:
|
|
- "Owners"
|