feat(report): identity & service-account hygiene pass (#17) - #33
Merged
Conversation
Detect-and-report (report-style, per roadmap decision): inventories the org's installed Apps and flags operator-declared machine users (OrgConfig.machineUsers) that are seat-consuming org members, recommending migration to Apps. Pure buildIdentityReport + render, folded into the compliance report (optional identity field, flips clean) and surfaced via `report --identity`. Machine users are operator-declared because the API can't reliably mark them. Action bundle rebuilt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #17. Implemented as a report-style detect pass (per roadmap decision).
Adds identity & service-account hygiene as a detect-and-report pass (no mutation), folded into the
reportsubcommand.What it does
GET /orgs/{org}/installations) — Apps consume no seat — with per-installation permission counts.OrgConfig.machineUsers) that are currently seat-consuming org members, with a recommendation to migrate each to a GitHub App.Why operator-declared
GitHub's API doesn't reliably mark a "machine user" (they're ordinary user accounts), so warden can't auto-detect them — the org declares the known ones and the report cross-references them against live membership.
Shape
src/report/identity.ts:buildIdentityReport(installations, memberLogins, machineUsers)+renderIdentityReport. Unit-tested with mock inputs.identityfield (flipscleanwhen a machine user is flagged) and rendered as a section.github-warden report --identity(fetches installations + members, tolerating 403/404 as "no access/none").Verification
npx tsc --noEmitcleannpm testgreen (420 tests; +8 identity, +2 compliance-integration, +1 CLI)🤖 Generated with Claude Code