apiVersion: actions.lariza.dev/v1alpha1
kind: RunnerPolicyIntent
metadata:
  name: unprivileged-demo
spec:
  mode: audit
  allowedLabels: [lariza-test]
  protectedLabels: [image-build, talos-deploy]
  actionSources:
    allow:
      - github.com/actions/checkout
    requireImmutableReferences: true
  tokenPermissions:
    default: {contents: read}
    maximum: {contents: read, issues: write}
  concurrency:
    repositoryMaximum: 1
  schedules:
    enabled: false
  secrets:
    allowForkPullRequests: false
    requireEnvironmentApproval: true