Adopt the GitHub surface unblocked by provider-upjet-github TF 6.13.0 (rulesets, Actions SHA-pinning, collaborators) #121

Activity

1. devantler

   added a parent issue on Jul 25, 2026

   • Adopt supported GitHub rulesets and track remaining provider gaps #69
2. devantler

   added the

   Feature

   issue type on Jul 25, 2026
3. github-project-automation

   added this to 🌊 Project Boardon Jul 25, 2026
4. coderabbitai commented on Jul 25, 2026

   

   coderabbitaiBot

   on Jul 25, 2026 – with coderabbitai

   More actions

   🔗 Related PRs

   #74 - feat(rulesets): require the CodeRabbit review status check org-wide [merged]
   #75 - revert(rulesets): drop the provider-uncreatable CodeRabbit required-check ruleset [merged]
   #78 - feat(repositories): declare provider-upjet-unifi (net-new Library repo) [merged]
   #86 - fix: gate repository-permissions/ until provider-upjet-github supports shaPinningRequired [merged]
   #88 - feat: archived-repo pattern + reusable-workflows archival groundwork [merged]

   ---

   📝 Issue Planner

   _{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

   • Create Plan

   ---

   🧪 Issue enrichment is currently in open beta.

   You can configure auto-planning by selecting labels in the issue_enrichment configuration.

   To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

   issue_enrichment:
     auto_enrich:
       enabled: false

   💬 Have feedback or questions? Drop into our discord!
5. devantler

   marked this as blocked on Jul 25, 2026

   • Repin provider-upjet-github to the first release bundling terraform-provider-github >= 6.13.0 platform#2800
6. devantler

   moved this to 📥 Backlog in 🌊 Project Boardon Jul 25, 2026
7. devantler commented on Sep 25, 2026

   

   devantler

   on Sep 25, 2026

   ContributorAuthor

   More actions

   🤖 Generated with Claude Code in an interactive session with the maintainer.

   Status check (2026-09-25): the SHA-pinning precondition is now met

   • Production runs provider-upjet-github v0.20.0. The live repositorypermissions.actions.github.m.upbound.io CRD exposes shaPinningRequired, alongside allowedActions, allowedActionsConfig, enabled and repository. The CRD being installed also means its resource definition is active in the platform, which is what stalled the tenant health check on 2026-07-09.
   • deploy/repository-permissions/ is still commented out of deploy/kustomization.yaml, so SHA pinning is still not enforced anywhere.

   What is left before wiring it in: an organization-wide audit that every uses: in every managed repository is pinned to a full commit SHA, since enforcement breaks a workflow the moment it meets a tag. Local ./ references are exempt. The catalogue move to this repository (#243) adds no remote self-references, so it does not change that audit.
8. devantler commented on Sep 25, 2026

   

   devantler

   on Sep 25, 2026

   ContributorAuthor

   More actions

   🤖 Generated with Claude Code in an interactive session with the maintainer.

   SHA-pin audit (read-only, 2026-09-25)

   Every uses: on the default branch of all 23 active repositories, across 144 workflows and 52 action.yml/action.yaml files, 1,232 references in all:

   • 1,227 comply: 1,040 are pinned to a full SHA and 187 are local ./ paths. Every one of the 80 first-party devantler-tech/... references is SHA-pinned.
   • 1 real violation: platform-template .github/workflows/bootstrap.yaml:127 uses actions/create-github-app-token@v3, deliberately, via a zizmor.yml allowance for actions/*. It needs pinning, and that allowance should go so it cannot let tags back in.
   • 1 template gap: .github workflow-templates/example.yaml:14 uses actions/checkout@v6. It breaks no existing workflow, but anything created from the template would fail under enforcement.
   • 4 lines to check, not fix: ksail system-test-hetzner.yaml uses $/.github/actions/... (lines 261, 296, 365, 372). This is GitHub's self-repository syntax: the 2026-09-25 run log shows it resolving to devantler-tech/ksail/.github/actions/ksail-cluster@<the workflow's own SHA>. That run failed on an SSH timeout, which ksail#7288 addresses, not on resolution. Before enforcement, confirm that sha_pinning_required accepts this form. It resolves to a full SHA, but that is an assumption until observed.

   So enforcement is two small fixes and one verification away.
9. devantler

   added 2 commits that reference this issue on Sep 25, 2026

   fix(ci): pin the bootstrap token action to a commit (#201)

   ...

   5d1352c

   fix(templates): pin the example workflow's checkout to a full commit …

   ...

   5bcc025
10. devantler commented on Sep 25, 2026

    

    devantler

    on Sep 25, 2026

    ContributorAuthor

    More actions

    🤖 Generated with Claude Code in an interactive session with the maintainer.

    Both audit fixes merged (2026-09-25):

    • fix(ci): pin the bootstrap token action to a commit platform-template#201 pins actions/create-github-app-token to a commit and removes the zizmor exception that allowed tags.
    • fix(templates): pin the example workflow's checkout to a full commit SHA #246 pins the organization's example workflow template.

    Every uses: on every active repository's default branch is now either SHA-pinned or local. The one open question is whether sha_pinning_required accepts GitHub's $/ self-repository form, which ksail uses in four places. After that, wiring deploy/repository-permissions/ into deploy/kustomization.yaml turns enforcement on.
11. devantler commented on Sep 25, 2026

    

    devantler

    on Sep 25, 2026

    ContributorAuthor

    More actions

    🤖 Generated with Claude Code in an interactive session with the maintainer.

    $/ self-repository references are accepted under SHA pinning, verified live (2026-09-25). platform already enforces sha_pinning_required, so I pushed a throwaway branch there with two push-triggered probe workflows, then deleted the branch (commit a4dc03aae0102fe27a1a6ea58b58edcdd61f9b5a):

    • Control: a step using actions/checkout@v6 was refused at job setup: "The action actions/checkout@v6 is not allowed in devantler-tech/platform because all actions must be pinned to a full-length commit SHA." So enforcement was live for the probe.
    • Probe: a step using uses: $/.github/actions/probe-self-repo ran and succeeded. GitHub resolved it to devantler-tech/platform/.github/actions/probe-self-repo@a4dc03aae0102fe27a1a6ea58b58edcdd61f9b5a, the running commit's full SHA.

    This matches GitHub's changelog for the syntax. ksail's four $/ references are therefore safe under enforcement, and every audit item above is closed. Next: wire deploy/repository-permissions/ in.
12. devantler

    added a sub-issue on Sep 25, 2026

    • Turn on SHA pinning by publishing deploy/repository-permissions/ #253
13. devantler

    added a commit that references this issue on Sep 25, 2026

    feat(github): require actions pinned to a full commit SHA on every re…

    ...

    0afe4c0
14. devantler commented on Sep 25, 2026

    

    devantler

    on Sep 25, 2026

    ContributorAuthor

    More actions

    🤖 Generated with Claude Code in an interactive session with the maintainer.

    SHA pinning is enforced (2026-09-25). #255 (fixes #253) published deploy/repository-permissions/ with all 21 active repositories, actions included. After release, every RepositoryPermissions is Synced/Ready, and GitHub reports sha_pinning_required: true on all 21. Two acceptance items here are done: the provider repin (v0.20.0, where the CRD carries shaPinningRequired), and the permissions reconciling with live GitHub confirming enforcement. Per-repository rather than organization-wide was the path taken, since it needs no organization-level App scope and keeps archived repositories out.

    Still open here: adopting the six repository-property org rulesets, the copilotCodeReview ruleset, the push-rulesets decision, RepositoryCollaboratorSet, and the #69/#85 updates.