opschain security git-policies
Included from Basic tier
Manage the git identity policy allow list. Each entry allows one configured remote — globally or for one project — at a set of rev globs for a set of principals:
| field | meaning |
|---|---|
| scope | global, or a project code (the delegation boundary) |
| remote | the configured remote's name on nodes in scope |
| rev patterns | allowed rev globs (* any sequence, ? one character); default * (all revs) |
| principals | covered users/groups; none means anyone with path rights |
| default | marks the remote as the explicit git-identity default for its scope |
| seeded | grandfathered at upgrade; cleared by the first reviewed replace |
Evaluation is the union of allows across global entries and the owning
project's entries; no matching entry means deny (unless the estate-wide
allow-all switch is on — see mode). Entries never narrow one another.
At upgrade, every existing configured remote was seeded an entry (all revs,
everyone, seeded: true) so running estates continue unchanged; remotes
configured after the upgrade start denied, and configuring one warns
"unusable until allow-listed".
Project security administrators manage their project's entries only; global entries and the switch belong to the global security administrator (and superusers). Every write is audited and takes effect on the next authorisation decision.
Subcommands
list,show <id>,put,delete <id>— the entries.mode— show or flip the estate-wide allow-all switch.
See also
opschain docs cli/security-git-policies-listopschain docs cli/security-git-policies-putopschain docs cli/security-git-policies-mode