unkinben
f720133314
Why: - An audit for the new unkin-agent bot (org-wide write) found repos with no branch_protection at all, so the agent (or anyone with write) could push straight to their default branch. - The rest of the estate protects default branches; these repos were the gap. How: - Add enable_push: false + approval_whitelist_teams: Owners on each active repo's default branch, matching the estate's most common convention (PR-only; Owners can still open and approve). - Omit status checks on these repos as none run CI, so a required context would permanently block merges. - Leave the 8 archived repos untouched: they are read-only, nothing can push to them, and branch-protection creation on archived repos is rejected.
9 lines
229 B
YAML
9 lines
229 B
YAML
description: "A repository for building initrd.img in docker "
|
|
private: false
|
|
default_delete_branch_after_merge: true
|
|
branch_protection:
|
|
- rule_name: "main"
|
|
enable_push: false
|
|
approval_whitelist_teams:
|
|
- "Owners"
|