4 ms·
It would be wonderful if there were bulk editing of Dependabot settings across multiple repos. The weakest part of GitHub is the lack of bulk administrative ed
by zdw 5y ago
It would be wonderful if there were bulk editing of Dependabot settings across multiple repos. The weakest part of GitHub is the lack of bulk administrative edits (repo settings, not code changes) across multiple repos.
This affects group (team) permissions as well - having to add a new team to multiple repos with specific permissions is a manual slog and hard to audit. Even the expanded permission categories are frequently inadequate - there's no CI focused "Let these users write to the repo and change hooks" permission level - all CI systems that self-manage hooks need full Admin rights.
The other code hosting I actively use is Gerrit, and the ability to hierarchically control what groups have specific permissions on multiple repos is far simpler and easier to use, from an admin perspective.
- veverkap 5y agoAt a previous employer, we used Terraform to manage GitHub teams/repos/permissions. It worked ... okay. Might be worth a try for you?
- newman314 5y agoCan you expand a bit more on how you achieved this? It sounds interesting.
- onei 5y agoThere's a GitHub provider for Terraform [1]. I tried it out on a GitHub Enterprise instance last year and found it a little awkward because they didn't have support for the latest GH APIs and the version before was missing a bunch of features. When I looked recently, they seemed to have got past that. The principle is broadly the same as other Terraform workflows: import existing config and update it when you need to. You can manage repo permissions, people and teams, all centrally and in code. Super useful for tracking changes (the GH audit logs are a bit lacking in my experience) and identifying discrepancies between the expected and actual configurations. [1] https://registry.terraform.io/providers/integrations/github/latest/docs https://registry.terraform.io/providers/integrations/github/...
- d4mi3n 5y agoWe did something similar to this at an org I worked at. We'd pull users from specific groups from our identity provider (Okta) and use that to provision corporate accounts to a Github Enterprise instance. One big downside to this approach is Github teams often don't line up 1-to-1 with an organization's reporting structure, so you don't really ever get away from needing to manually manage user-team memberships, but it does remove the need to onboard/offboard users manually.
- xevrem 5y agoThis is why we use GitLab over GitHub.
- xorcist 5y agoPuppet and Ansible are great for this type of things. If you want a new repo for your group, you make a pull request for our management repo. There are a bunch of access rights, hooks and tokens that need to be set up in a certain way depending on the type of repo, and Ansible regularly makes sure no one deviates from the intended configuration. Github (or Bitbucket or Gitlab) isn't different from any other software in this regard.
- mikewhy 5y agoDoes GitHub have "system level" webhooks like gitlab? That's what I've done previously, so when anyone creates a repo, it's configured as the org expects. This page[1] seems to mention organization level hooks that receive repository created events, if making your team edit a terraform/puppet/ansible/chef repo to simply create a repo seems overkill to you [1]: https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#repository https://docs.github.com/en/developers/webhooks-and-events/we...
- H12 5y agoI'd love it if there was more org-level functionality in general, for both content and configuration.