Repository navigation
docs: org settings stay human-applied, outside terraform - #268
Merged
Merged
Conversation
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Title check |  |
The title is specific, related to the documentation changes, and under 72 characters, but it is descriptive rather than imperative. | Use an imperative title, such as "docs: document org settings as human-applied". |
| Linked Issues check | |
For #176, the PR records the no-CI-management decision, corrects the terraform/README.md annotation, and updates ADR-0003. The conditional github_organization_settings adoption does not arise. How… |
Narrow the PAT permission as required by #176, or obtain and record an issue-level decision that supersedes that requirement before closing #176. |
-
Check name Status Explanation Description check The description clearly explains the decision to keep organization settings human-applied and documents the related Terraform and ADR updates. Out of Scope Changes check The diff changes only the #176decision record in ADR-0003 and the related authentication annotation interraform/README.md. Both changes directly support the linked issue.Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Full details: Linked Issues check
-
Explanation
For
#176, the PR records the no-CI-management decision, corrects theterraform/README.mdannotation, and updates ADR-0003. The conditionalgithub_organization_settingsadoption does not arise. However,#176requires narrowing the PAT when CI must not hold org-settings write, and the PR explicitly keepsOrganization → Administration: Read and write.
- Fix all pre-merge checks with AI
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Contributor
terraform plan (success) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#176 asked for a decision before any adoption of
github_organization_settings: should the CI apply be able to mutate org settings at all? The answer recorded here is no. The resource manages roughly twenty org fields as one unit, and declaring it would let an apply triggered by any unrelated merge change org-wide membership defaults. That widens the rails this tree describes for a setting that changes rarely and by deliberate human action. Org settings therefore stay human-applied and outsideterraform/.Two documents said otherwise or left it open and are corrected: the
terraform/README.md§ Auth table annotated the Organization → Administration permission as "(repo creation only)", which described intent rather than what the level admits; it now says the level also admits org-settings writes and that this tree never exercises them. The ADR-0003 amendment's "open work owned by #176" sentence becomes the record of the decision.What this does not do: narrow the PAT. The Organization → Administration level is what repository creation requires, so the token keeps it and the annotation is the honest statement of use. The merge gate is unaffected either way;
protection.tfrestrictsmainby push allowlist regardless of the base permission.With the first acceptance item answered this way, the issue's own closing clause applies: items two to four (declare, import, comment, verify 2FA after apply) do not arise, and the fifth is this ADR edit.
Closes #176
🤖 Generated with Claude Code