Goal
Provide the owner-managed capability required to update the organization required-workflow pin without granting admin:org to CI, runners, repositories, or agents.
Scope
- Fixed organization: agiletec-inc
- Fixed ruleset target: resolve and verify the live required-workflow ruleset ID before implementation; do not trust stale documentation IDs.
- Supported operation: update only the immutable uses/source revision for the organization required workflow.
- Caller authentication: short-lived OIDC identity only.
- GitHub authorization: GitHub App installation token minted inside the broker; App private key remains in a non-exportable external vault.
- Request schema: allowlisted organization, ruleset ID, expected current revision, approved target revision, and change reason.
- Execution: GET current ruleset -> validate that only the workflow revision changes -> PUT -> GET read-back.
- Fail closed on enforcement, bypass actors, conditions, required status checks, workflow path, repository scope, or any unexpected field change.
- Return only operation ID and redacted audit result; never return App keys or installation tokens.
- Audit before/after values, caller identity, target revision, and outcome.
Acceptance criteria
- Unit tests reject repository-specific target changes and all protection weakening.
- Integration test exercises GitHub REST ruleset GET/PUT/read-back against a non-production ruleset or mocked API with the same schema.
- Production runbook has one-click invocation, approval point, rollback to the expected previous revision, and evidence commands.
- Live read-back proves the org ruleset points at the approved immutable SHA before dependent PRs are expected to merge.
- No repository workflow, self-hosted runner, or local gh credential receives admin:org.
References:
Goal
Provide the owner-managed capability required to update the organization required-workflow pin without granting admin:org to CI, runners, repositories, or agents.
Scope
Acceptance criteria
References: