unkin/terraform-git

Fork 0

T

unkinben f720133314

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

Protect default branches of unprotected active repos

Why:
- An audit for the new unkin-agent bot (org-wide write) found repos with
  no branch_protection at all, so the agent (or anyone with write) could
  push straight to their default branch.
- The rest of the estate protects default branches; these repos were the gap.

How:
- Add enable_push: false + approval_whitelist_teams: Owners on each active
  repo's default branch, matching the estate's most common convention
  (PR-only; Owners can still open and approve).
- Omit status checks on these repos as none run CI, so a required context
  would permanently block merges.
- Leave the 8 archived repos untouched: they are read-only, nothing can push
  to them, and branch-protection creation on archived repos is rejected.

2026-08-08 22:58:54 +10:00

.woodpecker

Escape VAULT_VERSION for woodpecker YAML substitution ($$ -> shell)

2026-07-25 00:32:19 +10:00

config

Protect default branches of unprotected active repos

2026-08-08 22:58:54 +10:00

environments

vault provider: skip child token creation in CI

2026-07-27 21:52:24 +10:00

modules/gitea_instance

user: add gitea-vault-admin site-admin bot and one-time Vault KV seeding