Repository navigation
The settings root declares the private repository platform-secrets #34
Description
The GitHub settings root declares the private repository platform-secrets, with the secret-scanning rule its line below decides for private repositories.
Caller
- P4: Flux decrypts SOPS-age secrets from platform-secrets #13, slice P4b: platform-secrets holds the encrypted secrets Flux decrypts. Its CI part (P4b1) runs on platform-secrets' own board, and the repository must be declared here first, because the root's plan fails on any undeclared repository (Every fleet repository's GitHub settings and the organisation rulesets live as code in platform #10, G1).
- Every fleet repository's GitHub settings and the organisation rulesets live as code in platform #10, line 1 A: every non-archived, non-fork fleet repository has secret scanning, push protection, Dependabot alerts, squash-only merging and delete-branch-on-merge, held by this root.
What is known
- Private repositories. Every managed repository today is public. On a private repository, secret scanning and push protection need GitHub Secret Protection, at 19 USD per active committer per month (github.com/security/plans, read 06.11.2026). The organisation is on GitHub Team. So Every fleet repository's GitHub settings and the organisation rulesets live as code in platform #10's line 1 cannot hold for platform-secrets without that purchase. The line below decides.
- Creation. The root cannot create a repository: an import of a missing name fails the plan, and Every fleet repository's GitHub settings and the organisation rulesets live as code in platform #10's safeguards say so. The head creates the repository with
gh repo create overnightworks/platform-secrets --private --add-readme. The readme avoids a first push into an empty repository under the PR-only ruleset. From creation until this slice lands, the operator's plan fails loudly on an undeclared repository and changes nothing, so this slice's pull request is built first and the creation follows shortly before its landing. - What catches plaintext in either option. platform-secrets' own coverage check (P4b1) refuses any value under
dataorstringDatathat is not a SOPSENC[…]value; quality's gitleaks runs in its gate. A random password matches no known key format, so GitHub's scanning would not see it either.
Files
src/opentofu/github/repositories.tf:platform-secretsjoinsmanaged; under A, nosecurity_and_analysisblock for a private repository.src/opentofu/github/tests/repository_listing.tftest.hcl: the listing test knows the private repository.
Done when
- S1 The plan on today's organisation, with platform-secrets created, imports platform-secrets and its Dependabot alerts, sets its merge flags to squash-only with delete-branch-on-merge, creates and destroys nothing, and shows no other change.
- S2 Under A, the plan holds no secret-scanning or push-protection change for platform-secrets and every public repository keeps both enabled. Under B, platform-secrets shows both enabled.
- S3 After the operator's
--apply, the next plan is empty. - S4
mise run github:testpasses, with the private repository in the listing test.
version = 1
now = "Opened 06.11.2026 by platform's head from the P4b1 plan; waits for the operator's ruling on the line below and his yes to creating platform-secrets."
next = "After the ruling, build the declaration, create the repository on his word, land, then the operator's --apply."
done_when = "platform-secrets is declared in the settings root with the ruled secret-scanning form, the operator's apply has run, and the next plan is empty."
scope = ["src/opentofu/github/repositories.tf", "src/opentofu/github/tests/repository_listing.tftest.hcl"]
size = "S"
[[expectation]]
text = "Das private Repo mit den verschlüsselten Schlüsseln wird auf dem gewählten Weg vor Klartext-Geheimnissen geschützt."
asked_on = 2026-11-06
ruling = "A"
ruled_on = 2026-11-06
card_hash = "sha256:ae6d4156a338a3b39da8db0c3fe4d8c1f2ea2d9723a5fe803f8c3a3a0cd350c4"
via = "chat"
question = "Soll GitHub selbst das neue private Repo für deine Schlüssel auf versehentlich hochgeladene Geheimnisse prüfen, für 19 Dollar im Monat?"
problem = "Auf privaten Repos prüft GitHub nur gegen Aufpreis; sonst liegt versehentlicher Klartext schon bei GitHub, bevor etwas anschlägt."
decision_kind = "data_risk"
area = "GitHub-Organisation"
topic = "Geheimnis-Prüfung im Schlüssel-Repo"
recommended = "A"
reason = "Im Repo liegen nur verschlüsselte Werte. Bekannte Schlüsselformen findet schon die Prüfung beim Commit auf deinem PC, bevor etwas GitHub erreicht, und die kostenlose Prüfung im Pull Request findet jeden unverschlüsselten Wert; ein zufälliges Passwort erkennt auch GitHub nicht."
[[expectation.option]]
name = "Kostenlose Prüfung reicht"
effect = "Das Repo bekommt alle anderen Schutz-Einstellungen; Geheimnisse prüfen der Commit auf deinem PC und der Pull Request, GitHubs eigene Prüfung bleibt aus."
notice = "Du merkst nichts; ein versehentlicher Klartext wird beim Commit oder spätestens im Pull Request rot."
cost = "Rutscht ein Klartext-Wert am Commit vorbei, liegt er im privaten Repo, bis du ihn austauschst."
undo = "reversible"
undo_how = "GitHubs Prüfung lässt sich später jederzeit zubuchen."
contract = "This slice adds platform-secrets to managed in src/opentofu/github/repositories.tf with Dependabot alerts, squash-only merging and delete-branch-on-merge held, and no security_and_analysis block for it: secret scanning and push protection are not held on a private repository without GitHub Secret Protection. #10's line 1 contract gains that exception for private repositories, and G3's weekly check knows it. Plaintext is caught by the PC's staged-commit gitleaks scan, quality's gitleaks in the gate and platform-secrets' coverage check; a plaintext value that reached GitHub is rotated."
[[expectation.option]]
name = "GitHub-Prüfung zubuchen"
effect = "Die Organisation bucht GitHubs Geheimnis-Schutz; GitHub weist einen Push mit einem bekannten Schlüsselformat ab, bevor er ankommt."
notice = "Ein Push mit einem erkannten Schlüssel wird abgewiesen; dazu kommt eine Rechnung von GitHub."
cost = "19 Dollar im Monat je aktivem Committer, heute du allein; ein zufälliges Passwort erkennt auch GitHub nicht."
undo = "reversible"
undo_how = "Abbestellen; ab dem nächsten Monat kostet es nichts mehr."
contract = "The operator purchases GitHub Secret Protection for the organisation; this slice adds platform-secrets to managed with the same five settings as every other managed repository, secret scanning and push protection included, and its plan shows them enabled."
Activity
FlexOr2 commentedon Nov 6, 2026
Journal, 06.11.2026: plan at the lane tip b02eb83, after the operator created platform-secrets.
scripts/apply_github_settings.shexited 2 (changes):Plan: 26 to import, 0 to add, 14 to change, 0 to destroy.allow_merge_commitandallow_rebase_mergego true → false,delete_branch_on_mergefalse → true, and the Dependabot alertsenabledfalse → true. Nothing is created or destroyed.--apply(Every fleet repository's GitHub settings and the organisation rulesets live as code in platform #10now) has not run. So the plan also imports the other 12 repositories and turns the two merge flags false on the 11 besides platform, exactly Every fleet repository's GitHub settings and the organisation rulesets live as code in platform #10 row 1's planned change.archive_on_destroyis a provider attribute and makes no GitHub change.--applyafter the landing, which applies G1 and this slice together. S4 is CI'sopentofujob, green on b02eb83.FlexOr2 commentedon Nov 6, 2026
Journal, 07.11.2026: the operator ran
scripts/apply_github_settings.sh --applyat origin/main e6be2c6. It printedApply complete! Resources: 26 imported, 0 added, 14 changed, 0 destroyed.The next plan by the head exited 0 withNo changes. Your infrastructure matches the configuration.So S3 holds, and with it G1's landing cell on #10 (the next plan is empty after the first apply).