Github Connection
GithubConnection
Defines the connection between the platform and a GitHub organization.
Roots a GitHub organization in the dependency graph and provisions the API credentials, organization memberships, and teams for it. Acts as the parent for the organization's licenses, PR templates, secrets, repository templates, and repositories, and aggregates their footprint for CI/CD sizing and workflow management.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a GithubConnection so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant GithubConnection. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, organization) are read by the engine to resolve this manifest's identity and its parent Organization in the dependency graph. |
| spec | Spec | Desired connection configuration. The authoritative, user-authored specification for this connection. See Spec. |
Executors
Aggregate CI/CD runner footprint.
Requested counts of self-hosted runners by OS, aggregated from child build definitions and used to size GitHub Actions runner compute across the organization.
| Property | Type | Description |
|---|---|---|
| ubuntu | int64 | Number of Ubuntu runners requested. |
| macos | int64 | Number of macOS runners requested. |
| windows | int64 | Number of Windows runners requested. |
ManagedWorkflowsPrivateEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
ManagedWorkflowsPublicEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
RelatedArtifactRegistriesEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedRelatedArtifactRegistry |
RelatedExternalRegistriesEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedRelatedExternalRegistry |
SecretsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedGithubSecretRepositories |
Spec
User-provided connection configuration.
Identifies the target GitHub organization, how to authenticate to its API, and which users hold administrative access. This organization is the root scope for all repository, team, and secret operations under the connection.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of this connection. Optional free text describing the organization. Not propagated onto any provisioned GitHub resource; it exists purely as documentation and to give AI assistants context about the structure of the organization. |
| owner | string | Target GitHub organization name. The GitHub organization (account owner) this connection maps to; it is the root scope for all repository, team, and secret generation under the connection. Consumed when provisioning the connection data source and matched against the parent Organization's GitHub organization to decide whether to reuse core credentials. |
| authenticationMethod | string | GitHub API authentication method. How the engine authenticates to the GitHub API. Constrained to PERSONAL_ACCESS_TOKEN or GITHUB_APP. When PERSONAL_ACCESS_TOKEN, the platform provisions a secret in the core project to hold the PAT; the executor's credential-reuse path is currently keyed on this value. |
| hostname | string | GitHub instance hostname. Hostname of the GitHub instance (e.g. github.my-company.com); set only for GitHub Enterprise Server. Defaulted by the engine to github.com when omitted, and passed through to the provisioned connection data source and inherited by child repositories as connection_hostname. |
| administrators | list of string | Organization administrators. GitHub usernames to grant the admin role in the organization. Each name is resolved through its OrganizationUser GitHub external account into a computed administrator, then provisioned as an admin membership and treated as a maintainer on generated teams. |
ComputedRelatedExternalRegistry
Groups an External Registry with a list of dependent repository names.
Associates specific application repositories to a configured external registry.
| Property | Type | Description |
|---|---|---|
| repositories | list of string | Names of the application repositories that pull from this external registry. |
| registry | ComputedExternalRegistry | The resolved external registry these repositories depend on. |
ComputedGithubSecretRepositories
Represents the computed relationships between a GitHub secret and its target repositories.
This is an internal state object used by the engine to track which repositories a specific GithubSecret manifest has been distributed to during gitops reconciliation.
| Property | Type | Description |
|---|---|---|
| secretKey | string | The name of the secret. |
| repositories | list of string | A list of repositories where this secret is configured. |
ComputedRelatedArtifactRegistry
Groups an Artifact Registry with a list of dependent repository names.
Used to correlate an environment's registry with the specific application repositories built into it, simplifying the generation of IAM and image paths.
| Property | Type | Description |
|---|---|---|
| repositories | list of string | Names of the application repositories built into this registry. |
| registry | ComputedArtifactRegistry | The resolved Artifact Registry these repositories depend on. |
ComputedExternalRegistry
Represents a computed external container registry dependency.
Resolves the linkage between external registry configurations and the GCP / GitHub secrets containing their authentication credentials.
| Property | Type | Description |
|---|---|---|
| name | string | This value is a direct reflection of 'metadata.name' from the 'ExternalRegistry' manifest. |
| type | string | This value is a direct reflection of 'spec.type' from the 'ExternalRegistry' manifest. |
| publishUrl | string | This value is a direct reflection of 'spec.url' from the 'ExternalRegistry' manifest. |
| authentication | string | This value is a direct reflection of 'spec.authentication' from the 'ExternalRegistry' manifest. |
| usernameGcpSecretId | string | This value is populated by looking up a 'Secret' manifest with a conventional name, typically '<registryName>-username', and retrieving its fully qualified GCP resource StateID. |
| usernameSourceControlSecretId | string | This value is populated by looking up a 'GithubSecret' manifest with a conventional name, typically '<registryName>-username', and retrieving its name. |
| passwordGcpSecretId | string | This value is populated by looking up a 'Secret' manifest with a conventional name, typically '<registryName>-password', and retrieving its fully qualified GCP resource StateID. |
| passwordSourceControlSecretId | string | This value is populated by looking up a 'GithubSecret' manifest with a conventional name, typically '<registryName>-password', and retrieving its name. |
| region | string | The GCP region associated with the external registry, used for image path resolution. |
ComputedArtifactRegistry
Represents a computed Artifact Registry resource.
JIT-resolved state of an ArtifactRegistry manifest containing the definitive configuration utilized during the implementation phase.
| Property | Type | Description |
|---|---|---|
| name | string | This value is a direct reflection of 'metadata.name' from this 'ArtifactRegistry' manifest. |
| type | string | This value is a direct reflection of 'spec.type' from this 'ArtifactRegistry' manifest. |
| publishUrl | string | This URL is composed based on the 'spec.type' from this 'ArtifactRegistry' manifest. |
| region | string | This value is taken from 'spec.region' from this 'ArtifactRegistry' manifest. |
| permissions | ArtifactRegistryAccessPermissions | This block is a direct reflection of the 'spec.permissions' block from this 'ArtifactRegistry' manifest, with user and group names resolved to their full Google Cloud Identity identifiers. |
ArtifactRegistryAccessPermissions
Defines access levels specifically for Artifact Registry repositories.
Maps readers and writers to roles/artifactregistry.reader and roles/artifactregistry.writer respectively on the targeted google_artifact_registry_repository.
| Property | Type | Description |
|---|---|---|
| readers | DetailedAccessPermissions | A list of users and groups who are granted read-only access to the repository. Corresponds to the 'roles/artifactregistry.reader' IAM role. |
| writers | DetailedAccessPermissions | A list of users and groups who are granted read and write access to the repository. Corresponds to the 'roles/artifactregistry.writer' IAM role. |
DetailedAccessPermissions
Aggregation of specific user and group access definitions.
Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.
| Property | Type | Description |
|---|---|---|
| members | list of string | A list of 'OrganizationUser' manifest names to be included in this permission set. |
| groups | list of string | A list of 'OrganizationUserGroup' manifest names to be included in this permission set. |