reynold
1aa5b38eb3
Add synthetic fixtures and proposed policy contracts for safely demonstrating future Lariza capabilities. Assisted-by: Codex: GPT-5.6
23 lines
548 B
YAML
23 lines
548 B
YAML
apiVersion: actions.lariza.dev/v1alpha1
|
|
kind: RunnerPolicyIntent
|
|
metadata:
|
|
name: unprivileged-demo
|
|
spec:
|
|
mode: audit
|
|
allowedLabels: [lariza-test]
|
|
protectedLabels: [image-build, talos-deploy]
|
|
actionSources:
|
|
allow:
|
|
- github.com/actions/checkout
|
|
requireImmutableReferences: true
|
|
tokenPermissions:
|
|
default: {contents: read}
|
|
maximum: {contents: read, issues: write}
|
|
concurrency:
|
|
repositoryMaximum: 1
|
|
schedules:
|
|
enabled: false
|
|
secrets:
|
|
allowForkPullRequests: false
|
|
requireEnvironmentApproval: true
|