chore: eject repo policy compliance #665

yanksyoon · 2025-12-02T10:21:33Z

Applicable spec:

Overview

Rationale

Juju Events Changes

Module Changes

Library Changes

Checklist

The charm style guide was applied.
The contributing guide was applied.
The changes are compliant with ISD054 - Managing Charm Complexity
The documentation for charmhub is updated.
The PR is tagged with appropriate label (urgent, trivial, complex).
The changelog is updated with changes that affects the users of the charm.
The application version number is updated in github-runner-manager/pyproject.toml.

…sitories

…tests

…lass

…ation

…t fixture

…mpliance

…nt handling

cbartz

Thank you!

Some comments, mostly on the docs:

Could we clarify the term "external contributor"? We have the special case that bot accounts like renovate with push_allowance are allowed to run on internal prs, although not being Collaborator,member or admin
I think LXD docs don't need to be updated, because the lxd-mode charm will still install repo policy using pip

Can you also please update the PR description and ask @erinecon for reviewing the docs?

docs/changelog.md

tests/integration/test_charm_metrics_failure.py

docs/explanation/charm-architecture.md

docs/explanation/security.md

docs/how-to/comply-security.md

docs/how-to/manage-external-contributors.md

cbartz · 2025-12-10T06:45:16Z

docs/local-lxd/explanation/charm-architecture.md

I think we have not touched the code for lxd (as it lives in a legacy branch), so the lxd-mode charm will still install repo policy using pip and install locally, no ?
Therefore I think it is not necessary to modify the lxd docs in this PR.

github-actions · 2025-12-11T03:00:16Z

TICS Quality Gate

❌ Failed

The following errors have occurred during analysis:

❌ [ERROR 5333] Project database 'github-runner-operator' already is connected to a started TICSQServer process that has not registered a stop time. To avoid data corruption, analysis is aborted. Details of the other TICSQServer process: started at 2025-11-27 14:31:37.000 by user ubuntu.

.github/workflows/tics.yaml / TICS / TICS GitHub Action

erinecon

Thanks for updating the documentation! A few comments on my side

erinecon · 2025-12-11T14:24:29Z

docs/explanation/security.md


 - Only register the GitHub self-hosted runners to a trusted organization or repository so that only workflows from trusted users are able to run on the runners.
- For outside collaborators: Use the [`repo-policy-compliance` charm](https://charmhub.io/repo-policy-compliance) with [policy for outside collaborators](https://charmhub.io/github-runner/docs/how-to-comply-security#working-with-outside-collaborators) to ensure the code executed in runners are reviewed by a trusted user.
+- For outside collaborators: Use the `allow-external-contributor` configuration option (set to `false`) to restrict workflow execution to users with COLLABORATOR, MEMBER, or OWNER status. This prevents unauthorized code execution from untrusted external contributors.


Seems like "untrusted" has made Vale unhappy, I recommend adding it to accept.txt

erinecon · 2025-12-11T14:28:06Z

docs/how-to/comply-security.md

+1. External contributors create pull requests as usual
+2. A repository maintainer with COLLABORATOR, MEMBER, or OWNER status reviews the code
+3. If the code is safe, the maintainer can:
+  - Approve and merge the pull request to another branch (workflows will run with the maintainer's permissions)


maintainer's is another word to add to accept.txt, unless you want to work around it:

Suggested change

- Approve and merge the pull request to another branch (workflows will run with the maintainer's permissions)

- Approve and merge the pull request to another branch (workflows will run with the permissions of the maintainer)

erinecon · 2025-12-11T14:28:58Z

docs/how-to/comply-security.md

+- `OWNER` - Repository or organization owners
+- `MEMBER` - Organization members  
+- `COLLABORATOR` - Users with explicit collaborator access


Suggested change

- `OWNER` - Repository or organization owners

- `MEMBER` - Organization members

- `COLLABORATOR` - Users with explicit collaborator access

- OWNER - Repository or organization owners

- MEMBER - Organization members

- COLLABORATOR - Users with explicit collaborator access

To be consistent with the rest of the documentation

erinecon · 2025-12-11T14:30:00Z

docs/how-to/manage-external-contributors.md

+
+### Disabling external contributor access
+
+To prevent external contributors from triggering workflows:


Suggested change

To prevent external contributors from triggering workflows:

To prevent external contributors from triggering workflows, run:

Alternate suggestion:

Suggested change

To prevent external contributors from triggering workflows:

Prevent external contributors from triggering workflows:

erinecon · 2025-12-11T14:30:17Z

docs/how-to/manage-external-contributors.md

+- `OWNER` - Repository or organization owners
+- `MEMBER` - Organization members
+- `COLLABORATOR` - Users with explicit collaborator access


Suggested change

- `OWNER` - Repository or organization owners

- `MEMBER` - Organization members

- `COLLABORATOR` - Users with explicit collaborator access

- OWNER - Repository or organization owners

- MEMBER - Organization members

- COLLABORATOR - Users with explicit collaborator access

erinecon · 2025-12-11T14:30:27Z

docs/how-to/manage-external-contributors.md

+- `MEMBER` - Organization members
+- `COLLABORATOR` - Users with explicit collaborator access
+
+### Enabling external contributor access


Suggested change

### Enabling external contributor access

### Enable external contributor access

erinecon · 2025-12-11T14:30:38Z

docs/how-to/manage-external-contributors.md

+- `pull_request_review_comment` - Comments on pull request diffs from external contributors
+- `issue_comment` - Comments on issues or pull requests from external contributors
+
+### Disabling external contributor access


Suggested change

### Disabling external contributor access

### Disable external contributor access

erinecon · 2025-12-11T14:32:45Z

docs/how-to/manage-external-contributors.md

+1. Set `allow-external-contributor=false`
+2. Review repository collaborator permissions
+3. Check for any bypass rules in branch protection settings
+4. Audit recent workflow runs in the GitHub Actions tab


This doesn't seem like how-to material to me. A how-to guide should provide task-based instructions for accomplishing a goal, and this information seems more like explanation or reference material.

I recommend moving the ## Recommended security practices section into the Security document, and the ## Troubleshooting section into a standalone # How to troubleshoot type of document.

Seems like this comment got messed up. To be totally clear, the material I'm referring to is the ## Recommended security practices and ## Troubleshooting sections (currently lines 43-92)

erinecon · 2025-12-11T14:33:18Z

docs/changelog.md

 ## 2025-12-01

- Added timeouts to API calls (Openstack,GitHub,Repo policy compliance) to fix a hanging GitHub runner manager application. 
+- Added timeouts to API calls (Openstack,GitHub,Repo policy compliance) to fix a hanging GitHub runner manager application.


Suggested change

- Added timeouts to API calls (Openstack,GitHub,Repo policy compliance) to fix a hanging GitHub runner manager application.

- Added timeouts to API calls (OpenStack, GitHub, Repo policy compliance) to fix a hanging GitHub runner manager application.

To make Vale happy

yanksyoon added 30 commits October 28, 2025 05:42

mark external repo-policy-compliance configurations as deprecated

2c94bc1

add allow-forked-repository charm configuration option

7ba3881

add deprecated configuration option warning

f19bbe7

use type casting for bool charm configs

8134a51

change config option name to allow-external-contributor

ef9b73c

parse allow-external-contributor charm config option

d753dc7

test: configuration parsing unit tests

89f2bad

fix: add use_aproxy default value

4ffd599

add allow_external_contributor configuration to application config

4ecc739

add deprecation warning for repo-policy-compliance-client

2498169

add allow_external_contributor option to application

dc3f022

test: initial forked repo testing

1e10fff

debug

d1d4c52

debug: ping me when test done

953fcb5

Merge remote-tracking branch 'origin' into feat/pre-job-fork-check

dc7c75d

feat: enhance integration tests for trusted and untrusted forked repo…

f2c7378

…sitories

feat: update GitHub client initialization to use Token authentication

e2350d0

chore: revert charm integration tests

32f9818

chore: revert charm integration tests

1eea0f7

chore: merge pre_job_contents_dict generation

56a182e

feat: add GitHub and OpenStack configuration options for integration …

596a559

…tests

refactor: simplify configuration file reading in RunningApplication c…

1e796ff

…lass

chore: remove deprecated OpenStack ARM64 options from pytest configur…

9200a9b

…ation

Merge remote-tracking branch 'origin' into feat/pre-job-fork-check

81fa6ec

feat: add integration tests configuration to GitHub Actions and tox

d4a3453

chore: lint fixes

7134402

refactor: streamline OpenStack options and remove deprecated token_al…

a850b00

…t fixture

chore: update integration test environment variables for OpenStack

3ef26d0

Merge branch 'chore/cleanup-tests' into feat/pre-job-fork-check

5c3934b

chore: undo charm CI testing changes

f295341

yanksyoon and others added 7 commits December 1, 2025 14:58

Merge branch 'main' into feat/pre-job-fork-check

9886120

feat: check all events that can be triggered by external contributors

f51a1f4

chore: eject repo-policy-compliance

cf54f91

test: eject repo policy configs

f4b381e

docs: replace repo-policy docs w/ allow-external-contributor

eb8eb5b

chore: introduce external-contributor-check-failure to metrics

2257373

Merge remote-tracking branch 'origin' into chore/eject-repo-policy-co…

86e6e0d

…mpliance

yanksyoon added the complex label Dec 3, 2025

yanksyoon added 5 commits December 3, 2025 05:29

chore: deprecation related changes

6946e3b

Enhance author association checks for internal PRs and streamline eve…

f166696

…nt handling

docs: improve docs & remove extra statements

3e239c6

feat: issue metrics on allow_external_contributor check failure

0b65ae2

chore: clean up comments

445f252

yanksyoon marked this pull request as ready for review December 9, 2025 04:21

yanksyoon requested review from cbartz, javierdelapuente and yhaliaw as code owners December 9, 2025 04:21

yanksyoon added 6 commits December 9, 2025 15:16

test: lint fixes

86ba951

Merge conflict fix

15d7e07

ci: remove removed test

258789e

doc: fix doc links

d6d3cde

doc: fix vale suggestions

c94f60a

fix: link

18ac204

cbartz reviewed Dec 10, 2025

View reviewed changes

yanksyoon added 2 commits December 11, 2025 11:40

docs: improve docs

8ff827c

docs: revert all lxd doc changes

157d269

yanksyoon requested a review from cbartz December 11, 2025 02:46

weiiwang01 approved these changes Dec 11, 2025

View reviewed changes

erinecon reviewed Dec 11, 2025

View reviewed changes

	- Approve and merge the pull request to another branch (workflows will run with the maintainer's permissions)
	- Approve and merge the pull request to another branch (workflows will run with the permissions of the maintainer)


		### Disabling external contributor access

		To prevent external contributors from triggering workflows:

	To prevent external contributors from triggering workflows:
	Prevent external contributors from triggering workflows:

	### Enabling external contributor access
	### Enable external contributor access

	### Disabling external contributor access
	### Disable external contributor access

	- Added timeouts to API calls (Openstack,GitHub,Repo policy compliance) to fix a hanging GitHub runner manager application.
	- Added timeouts to API calls (OpenStack, GitHub, Repo policy compliance) to fix a hanging GitHub runner manager application.

chore: eject repo policy compliance #665

Are you sure you want to change the base?

chore: eject repo policy compliance #665

Conversation

yanksyoon commented Dec 2, 2025

Overview

Rationale

Juju Events Changes

Module Changes

Library Changes

Checklist

Uh oh!

cbartz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 11, 2025

TICS Quality Gate

❌ Failed

The following errors have occurred during analysis:

Uh oh!

erinecon left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants