Skip to content

feat(github): enable protected action releases #5429

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 4 commits into from
Oct 27, 2026
Merged

feat(github): enable protected action releases #5429

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bf4474a
feat(github): enable protected release environments
devantler Oct 27, 2026
280f285
fix(github): record the scoped environment authorization
devantler Oct 27, 2026
7043cd4
Merge remote-tracking branch 'origin/main' into codex/release-environ…
devantler Oct 27, 2026
2489ffc
Merge remote-tracking branch 'origin/main' into codex/release-environ…
devantler Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions k8s/bases/apps/github-config/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ rules:
- repositoryrulesets
- issuelabels
- repositorycustomproperties
- environments
- environmentdeploymentpolicies
verbs:
- get
- list
Expand Down
4 changes: 4 additions & 0 deletions k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@ spec:
# Explicit custom-property assignments owned by the github-config tenant
# (devantler-tech/.github#773); organization schema remains a provider gap.
- repositorycustomproperties.repo.github.m.upbound.io
# Protected Marketplace action releases are declared by the github-config
# tenant (devantler-tech/.github#779). Secret custody is a separate gate.
- environments.repo.github.m.upbound.io
- environmentdeploymentpolicies.repo.github.m.upbound.io
# Org-level rulesets. Of the org's 20 org rules, the 10 provider-upjet-github
# can express are adopted Observe-first in devantler-tech/.github
# deploy/rulesets/ (+ a net-new tag-protection ruleset); the other 10
Expand Down
2 changes: 1 addition & 1 deletion scripts/validate-eks-ci-role-policy/approved-surface.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,7 +304,7 @@ rbac.authorization.k8s.io/v1|Role|data-product-controller|data-product-readiness

rbac.authorization.k8s.io/v1|Role|data-product-controller|khoist-documentation 35e63ab8f23f3de55976023d5c6144ac5a3cd7ed5c0947f1c451d74cf4167bef

rbac.authorization.k8s.io/v1|Role|github-config|github-config-managed-resources 07a7e586590a561fef323c6b988cb29850df5f0e58617d79e2250063c6a8fc2d
rbac.authorization.k8s.io/v1|Role|github-config|github-config-managed-resources f25e2b6e9407f0c330c23b428d3f467745fcdcdc1fa23153b4c8fcd7a286d8be

rbac.authorization.k8s.io/v1|Role|kubelet-serving-cert-approver|leader-election:kubelet-serving-cert-approver b73fcea5da2f0aad8552ff6a168372a6d47e9f4fb967c7df741ba89708240c73

Expand Down
Loading