berendt/gitstyring

Github management by Ansible.

Gitstyring

Github management by Ansible via specific role.

Ansible Role: Gitcontrol

Manage your organization repositories(later will add other stuff) at Github:

Structure

Describe all your organizations in orgs/{{ structure_name }}/,

Each organization must have next folder structure:

org:
  name:
    people:
      dismissed_members.yml
      members.yml
    repositories:
      repo_name.yml
    teams:
      dismissed_members.yml
      members.yml

Currently works only repo management

Repositories

Describe your repositories in orgs/my_org/repositories/my_repo.yml, file name should be equal to repo name, and one repo per file:

my_repo:
  default_branch: main
  description: >-
    Brief description.  Try to fit it in one line.  As linefeeds are not allowed here.
  homepage: https://example.com
  language: Python
  archived: true / false # this is one direction road: once archived the repo can be unarchived via web only
  has_issues: true / false
  has_projects: true
  has_wiki: true / false
  private: true / false
  delete_branch_on_merge: false
  allow_merge_commit: false
  allow_squash_merge: true
  allow_rebase_merge : false
  teams:
    maintain: # List of teams who need to manage the repository without access to sensitive or destructive actions.
    pull: # List of teams who can only read this repo.
    push: # List of teams with push access.
    admin: # List of admin teams.
      - csm
  collaborators:
    maintain: # List of members who need to manage the repository without access to sensitive or destructive actions.
    pull: # List of members who can only read this repo.
    push: # List of members with push access.
    admin:  # List of admin members.
      - anton-sidelnikov
  topics:  # List of repository topics.
    - a
    - b
    - c
  protection_rules: # do not change protection rules structure all fields is required
    main: # branch name which already created in branch protection rules
      required_status_checks:
        strict: true / false
        contexts: # The list of status checks to require in order to merge into this branch
          - eco/check
      enforce_admins: true
      required_pull_request_reviews:
        dismissal_restrictions:
          users: [] # list of members or empty list
          teams: [] # list of teams or empty list
        dismiss_stale_reviews: true
        require_code_owner_reviews: false
        required_approving_review_count: 1
      restrictions:
        users: [] # list of members or empty list
        teams: [] # list of teams or empty list
        apps: # list of app slugs with push access
          - otc-zuul
      required_linear_history: false
      allow_force_pushes: false
      allow_deletions: false

Protection rules can be setted up through templates which should exist in playbooks/templates

my_repo:
  default_branch: main
  description: >-
    Brief description.  Try to fit it in one line.  As linefeeds are not allowed here.
  homepage: https://example.com
  language: Python
  archived: true / false # this is one direction road: once archived the repo can be unarchived via web only
  has_issues: true / false
  has_projects: true
  has_wiki: true / false
  private: true / false
  delete_branch_on_merge: false
  allow_merge_commit: false
  allow_squash_merge: true
  allow_rebase_merge : false
  teams:
    maintain: # List of teams who need to manage the repository without access to sensitive or destructive actions.
    pull: # List of teams who can only read this repo.
    push: # List of teams with push access.
    admin: # List of admin teams.
      - csm
  collaborators:
    maintain: # List of members who need to manage the repository without access to sensitive or destructive actions.
    pull: # List of members who can only read this repo.
    push: # List of members with push access.
    admin:  # List of admin members.
      - anton-sidelnikov
  topics:  # List of repository topics.
    - a
    - b
    - c
  protection_rules: template_name

• Those teams and collaborators should exist in organization.

How to use it

As a prerequisite, a PAT must be created. The rights repo and admin:org are required.

Firstly:

• export GITHUB_TOKEN="github-token"
• export GITHUB_USER="github-username"

To apply changes in your organization repositories run:

ansible-playbook playbooks/run.yml -e github_repos_state=present