[eliorerz]

Summary

Fills the last gap in what ci-duty needs to maintain CI and the merge queue. The CI/CD admin org role (#268) covers only org-level Actions settings (org secrets, variables, runners, policies). Anything set on the repository still needed repo admin. On osac that means:

• repo secrets: BUF_TOKEN, KONFLUX_SA_TOKEN, COPR_CUSTOM_WEBHOOK_URL, COPR_WEBHOOK_URL, FULLSEND_GCP_PROJECT_ID, FULLSEND_GCP_WIF_PROVIDER
• repo variables: FULLSEND_GCP_REGION, FULLSEND_MINT_URL, FULLSEND_PER_REPO_INSTALL
• environments, repo Actions settings and repo runners

This adds a custom repository role, ci-maintainer (base write), and gives it to ci-duty on osac and osac-test-infra in place of push.

Permission	API name
Manage repository Actions secrets	write_repository_actions_secrets
Manage repository Actions variables	write_repository_actions_variables
Manage environments, environment secrets and variables	write_repository_actions_environments
Manage repository Actions policies	write_repository_actions_settings
Manage repository Actions runners	write_repository_actions_runners
Jump to the front of the merge queue	jump_merge_queue
Request a solo merge	create_solo_merge_queue_entry

API names are from gh api /orgs/osac-project/repository-fine-grained-permissions. With this role, nobody has to re-enter secret values to move them to org level, and the fullsend per-repo install keeps its repo-level settings.

Changes

• organization.tf: new github_organization_repository_role.ci_maintainer.
• repositories.tf: on osac and osac-test-infra, ci-duty's permission changes from push to ci-maintainer. Its force-merge bypasses from NO-ISSUE: Let ci-duty force-merge on osac and enhancement-proposals #269 are unchanged.
• modules/common_repository/variables.tf: teams[].permission now also accepts a custom repository role name, matched as a lowercase name with a hyphen. A typo like pus is still rejected.
• README.md: documents the role under ci-duty.

Requirements

• The apply's GitHub App (org-config-management) already has organization_custom_roles: write, which custom repository roles need.
• The org already uses custom org roles (runner-manager), so custom repository roles (an Enterprise Cloud feature) are available.

Validation

• tofu fmt -check -recursive, tofu validate, pre-commit run --all-files: pass.
• Expected plan: 1 create (the role), in-place updates to the collaborators of repo_osac and repo_osac_test_infra, plus the recurring updates. I'll post the local plan output once it's run.
• After apply: as a ci-duty member who isn't an org owner, check that gh api repos/osac-project/osac/collaborators/<user>/permission --jq .role_name returns ci-maintainer, and that they can view osac's Settings → Secrets and variables → Actions.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: e00cb5e1-a4d5-47b7-b565-e39a32c3f837

📥 Commits

Reviewing files that changed from the base of the PR and between e0da690 and 211fc99.

📒 Files selected for processing: 4

• README.md
• modules/common_repository/variables.tf
• organization.tf
• repositories.tf

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 6 remain after this review.

⚠️ A high-level summary could not be generated for this review. CodeRabbit will regenerate it on the next update, or you can request a refresh with @coderabbitai summary.

Walkthrough

The configuration adds a custom ci-maintainer repository role, accepts custom role names in team permission validation, and assigns the role to ci-duty on osac and osac-test-infra.

Changes

CI Maintainer Repository Role

Layer / File(s)	Summary
Role definition and permission validation organization.tf, modules/common_repository/variables.tf	Defines the ci-maintainer role with a write base role and repository Actions, runner, and merge queue permissions. Team permission validation now accepts built-in permissions or custom role names matching the specified pattern.
Repository assignments and documentation repositories.tf, README.md	Assigns ci_maintainer to ci-duty on both repositories instead of push. The team documentation lists the role and its permissions.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested labels: risk:ask

Suggested reviewers: larsks

Merge Risk: ⚪ Minimal · up to 211fc

This change adds a custom repository role for the ci-duty team and documents it. No concrete merge-blocking risk was found; check the first plan and apply for the two repositories.

Pre-merge checks: 11

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: adding the ci-maintainer repository role for ci-duty.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets		The pull request adds only role names, permission identifiers, documentation, and secret-name references such as BUF_TOKEN and KONFLUX_SA_TOKEN. The diff contains no secret values, API keys, passw…
No-Weak-Crypto		PASS: The pull request adds a GitHub custom repository role, permission validation, documentation, and role assignments. The changed lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto,…
No-Injection-Vectors		PASS. The pull request adds Terraform role and permission values, documentation, and a regex validation. The changed code contains no SQL concatenation, shell execution, eval/exec, pickle.loads, unsaf…
Container-Privileges		The pull request changes only README.md and OpenTofu Terraform files for repository roles and permissions. The diff introduces no container or Kubernetes manifest fields for privileged mode, hostPID, …
No-Sensitive-Data-In-Logs		PASS: The PR adds Terraform configuration and documentation only. It does not add logging or output of secret values, tokens, API keys, PII, session IDs, hostnames, or customer data. The added comment…
Ai-Attribution		The PR mentions Claude Code and includes the required Assisted-by: Claude Code (Claude Opus 5.5) <noreply@anthropic.com> commit trailer. No AI Co-Authored-By trailer is present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

Full details: No-Hardcoded-Secrets

Explanation

The pull request adds only role names, permission identifiers, documentation, and secret-name references such as BUF_TOKEN and KONFLUX_SA_TOKEN. The diff contains no secret values, API keys, passwords, private-key material, base64 blobs, credential-bearing URLs, or credential variables assigned string literals.

Full details: No-Weak-Crypto

Explanation

PASS: The pull request adds a GitHub custom repository role, permission validation, documentation, and role assignments. The changed lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparisons. References to Actions secrets and token names are access-scope documentation only.

Full details: No-Injection-Vectors

Explanation

PASS. The pull request adds Terraform role and permission values, documentation, and a regex validation. The changed code contains no SQL concatenation, shell execution, eval/exec, pickle.loads, unsafe yaml.load, os.system, or dangerouslySetInnerHTML. The custom role name flows directly to the GitHub provider collaborator permission field.

Full details: Container-Privileges

Explanation

The pull request changes only README.md and OpenTofu Terraform files for repository roles and permissions. The diff introduces no container or Kubernetes manifest fields for privileged mode, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root execution, or allowPrivilegeEscalation.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The PR adds Terraform configuration and documentation only. It does not add logging or output of secret values, tokens, API keys, PII, session IDs, hostnames, or customer data. The added comment mentions only secret variable names such as BUF_TOKEN and KONFLUX_SA_TOKEN, not their values.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}