Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Be prescriptive on archived repos (including removing permissions) #116

Open
BigLep opened this issue Feb 8, 2024 · 0 comments
Open

Be prescriptive on archived repos (including removing permissions) #116

BigLep opened this issue Feb 8, 2024 · 0 comments

Comments

@BigLep
Copy link
Contributor

BigLep commented Feb 8, 2024

Problems

  1. github-mgmt YAML files can be unwieldy in part because of archived repos (see Remove clutter resulting from archived repos #115). One of the reasons is that the archived repos still have access permissions listed.
  2. Archived repos that have users/teams associated can be a security vulnerability. If a malicious (likely compromised) repo admin unarchives it, they could introduce bugs, vulnerabilities, etc.

Ideas

  1. When archiving a repo, remove all direct repo permissions (members and teams). In order to unarchive, someone would need to unarchive and add permissions through github-mgmt. In addition to reducing clutter while in an archived state, this is good because it gives clear visibility to a significant repo event (e.g., unarchiving).
  2. Even if one doesn't want this to be an automated step, this could be a one-off script/check that somebody runs. I assume a backfill operation of "remove permissions from archived repos" requires some sequencing though in that it would need to first be unarchived, have the permissions removed, and then be archived.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant