feat(#646): manage github repo configuration in the pulumi program - #704
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe Pulumi workspace adds GitHub repository management for labels, milestones, branch rules, environments, and Actions variables. It configures provider credentials and repository ownership, updates CI token loading, and documents the infrastructure and issue-hygiene workflow. ChangesGitHub infrastructure configuration
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
🍹
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@infra/github.ts`:
- Around line 242-248: Refactor github.ts to expose one primary GitHub
repository configuration export immediately after the imports, followed by
private resource declarations and helpers. Remove the seven individual exports
including labelCount, milestoneTitles, and the *Name outputs, then expose those
stack-level values from infra/index.ts instead. Rename the module to reflect its
single primary export and update all consumers accordingly.
- Around line 151-164: Update the RepositoryMilestone configuration in the
milestoneDefinitions mapping to use the configured stack owner instead of the
hardcoded 'zgeoff' value, reusing the existing owner configuration symbol used
by the GitHub provider setup.
- Around line 195-207: Update the productionEnvironment RepositoryEnvironment
declaration to explicitly configure its protection rules: define the intended
branch policy, required reviewers, wait timer, self-review prevention, and
administrator-bypass behavior. Preserve the existing production environment
name, repository association, and protect setting while replacing reliance on
provider defaults with explicit values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8288568b-f18b-42b8-b770-2423beac94ee
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock,!bun.lock
📒 Files selected for processing (11)
.github/workflows/infra-drift.ymlAGENTS.mdagents/project.mdinfra/.env.exampleinfra/Pulumi.prod.yamlinfra/README.mdinfra/github.tsinfra/index.tsinfra/package.jsoninfra/tsconfig.jsonpackage.json
Declares the zgeoff/vers labels, main-protection ruleset, production environment, and Actions variables as @pulumi/github resources, wires the provider PAT through op run and the infra-drift workflow, and points the issue-hygiene guidelines at the program as the label registry. The service-auth public key value enters through encrypted stack config, not source. Milestones, Actions secrets, and the delivery board stay console-managed: milestones are delivery state rather than schema, secret values cannot be read back, and Projects v2 lacks mature provider support.
zgeoff
force-pushed
the
646-github-config
branch
from
July 20, 2026 08:53
db4ca32 to
986d440
Compare
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes #646
Manages the zgeoff/vers repo configuration — labels, the
main protectionruleset, theproductionenvironment, and Actions variables — declaratively in the vers-infra Pulumi program, so the schema the issue-hygiene rules assume is reviewed and drift-checked instead of living as console state.IssueLabelsresource: console-added labels read as drift.pulumi upconfirms zero resource changes.GITHUB_TOKEN(fine-grained PAT,vers-civault) resolved byop run; owner comes fromgithub:ownerstack config.Testing
bun run typecheckpassesbun run testpassesbun run lintpassesContext
Infra changes are covered by the infra-drift preview (
expect-no-changesagainst prod state) rather than unit tests.