Skip to content

Be prescriptive on archived repos (including removing permissions) #116

@BigLep

Description

@BigLep

Problems

  1. github-mgmt YAML files can be unwieldy in part because of archived repos (see Remove clutter resulting from archived repos #115). One of the reasons is that the archived repos still have access permissions listed.
  2. Archived repos that have users/teams associated can be a security vulnerability. If a malicious (likely compromised) repo admin unarchives it, they could introduce bugs, vulnerabilities, etc.

Ideas

  1. When archiving a repo, remove all direct repo permissions (members and teams). In order to unarchive, someone would need to unarchive and add permissions through github-mgmt. In addition to reducing clutter while in an archived state, this is good because it gives clear visibility to a significant repo event (e.g., unarchiving).
  2. Even if one doesn't want this to be an automated step, this could be a one-off script/check that somebody runs. I assume a backfill operation of "remove permissions from archived repos" requires some sequencing though in that it would need to first be unarchived, have the permissions removed, and then be archived.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions