Repository navigation
Clarify organization-level configuration and console.viewer - #4281
Draft
tylerpaxton wants to merge 2 commits into
Draft
tylerpaxton wants to merge 2 commits into
tylerpaxton wants to merge 2 commits into
Conversation
Guardener's configuration page lists the Chainguard Checks and Chainguard Workspaces files right before its organization-level section, so they read as if the .github repository can supply them. Neither product reads them from there, so say so on that page. On the identities page, say that console.viewer isn't an IAM role name, and which built-in role to bind the assumable identity to. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
matthewhelmke
approved these changes
Oct 21, 2026
Resolve the lastmod conflict with #4302 by keeping main's later stamp. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
guardener/github/configuration.md: says that organization-level configuration from the.githubrepository covers only Guardener's files, and that Chainguard Checks and Chainguard Workspaces never readci.yaml,ci/, ordevelop.yamlfrom it.checks/identity-and-trust.md: on theconsole-api.enforce.devrow, says thatconsole.viewerisn't the name of an IAM role, and to bind the assumable identity to a role such asconsole_viewer.Why
The Guardener page lists the Checks and Workspaces files right before its organization-level section, so readers could expect the
.githubrepository to supply them. A repository without its own Checks configuration gets no checks.The other roles in the identities table share names with built-in IAM roles, so
console.viewerlooks like a typo forconsole_viewer. Writingconsole_viewerinidentities.yamlmakes the file invalid, and no checks run for that commit.How it was checked
actions.yamlandimages.yaml. Chainguard Checks reads its files only from the pull request's repository.chainctl develop0.2.388 readsdevelop.yamlonly from the directory or repository you open.identities.yamlparser. Forconsole-api.enforce.dev, it accepts onlyconsole.viewerand rejectsconsole_viewerwith anunsupported roleerror. No IAM role is namedconsole.viewer, and the built-inconsole_viewerrole includes every capability thatconsole.viewerallows.pre-commitandmarkdownlint-cli20.23.3 pass on both pages.For reviewers
Not changed: the organization-level example on the Guardener page lists
source.yaml, but Commit Verification appears to read only the repository's ownsource.yaml. The page also doesn't mention that Guardener checks a.github-privaterepository after.github. Both need a check with the Guardener team first.🤖 Generated with Claude Code