Github Repository
GithubRepository
Defines a managed GitHub repository within a connected organization.
Provisions the repository itself (visibility, feature toggles, access permissions) and its in-repo assets: generated CI/CD workflow files, a .github/CODEOWNERS file, and branch protection rules derived from the chosen branching strategy. Acts as the parent for the repository's BuildDefinition manifests.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a GithubRepository so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant GithubRepository. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, organization) are read by the engine to resolve this manifest's identity and its parent GithubConnection in the dependency graph. |
| spec | Spec | Desired repository configuration. The authoritative, user-authored specification for this repository. See Spec. |
BranchConfigEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedGithubBranchConfig |
ComputedCodeOwner
Resolved code-owner reference (a specific team or user).
| Property | Type | Description |
|---|---|---|
| id | int64 | Numeric identifier of the resolved team or user. |
| name | string | Name of the resolved team or user. |
| isTeam | bool | True when the owner is a team; false when it is an individual user. |
ComputedCodeOwnerEntry
Resolved code-owner assignment for a path pattern.
| Property | Type | Description |
|---|---|---|
| path | string | The path pattern these owners apply to. |
| owners | list of ComputedCodeOwner | Resolved owners for the path pattern. |
WorkflowsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
Spec
User-provided repository configuration.
Declares the repository's visibility, name, template/licensing, branching strategy, code ownership, access permissions, feature toggles, exposed secrets, and AI-assistant options.
| Property | Type | Description |
|---|---|---|
| public | bool | Repository visibility. When true the repository is public; when false (the default) it is private. Applied to the repository's visibility attribute, and also gates AI-assistant features which only activate on private repositories. |
| name | string | Repository name override. The repository's name on GitHub, used verbatim; when omitted, the manifest's metadata.name is used instead. This is the whole of the computed repository_name — no prefix or other decoration is applied. Changing it renames the repository, which the engine performs as an archive of the old name plus a create of the new one (repositories are archived, never deleted, and are unarchived if re-adopted). |
| description | string | Human-readable description of this repository. Optional free text describing the repository. Propagated onto the provisioned GitHub repository's description attribute, and used as context by AI assistants reasoning about the organization's structure. |
| template | string | Repository template selection. Name of a GithubRepositoryTemplate to base this repository on. Validated to reference an existing template and resolved into the computed template_repository (the template's prefixed name). Note: the executor does not currently apply the template when creating the repository; the resolved value is retained for schema/AI context and future template instantiation. |
| strategy | string | Branching strategy. Selects the branch layout and protection rules for the repository. Constrained to GIT_FLOW, GITHUB_FLOW, or TRUNK_BASED. Drives the computed default_branch and branch_config (the branch protection matrix applied by the executor). |
| codeOwners | list of CodeOwnerEntry | Code owners for repository paths. List of path/owner assignments used to generate the .github/CODEOWNERS file committed to the repository. Owners are rendered scoped to the connection owner. |
| pullRequest | PullRequestConfig | Pull request template configuration. References a GithubPullRequestTemplate whose content is resolved into the computed pull_request_template. See PullRequestConfig. Note: the engine does not currently write the resolved content to .github/pull_request_template.md. |
| license | string | License selection. Name of a GithubLicense manifest whose content is validated and resolved into the computed license. Note: the engine does not currently write the resolved content to a LICENSE file. |
| permissions | AccessPermissions | Repository access permissions. Users and teams granted admin, push (contributor), or pull (viewer) access. Applied as repository collaborator/team permissions by the executor, and also folded into the code-owner set and computed permissions (with identities resolved to full Cloud Identity identifiers). |
| configuration | Configuration | GitHub feature toggles. Enables or disables optional repository features (wiki, projects, issues, downloads). See Configuration. |
| secrets | list of string | Exposed GitHub Actions secrets. Names of GithubSecret manifests to make available to this repository's GitHub Actions workflows. Each name registers this repository against the organization-level secret so the secret is bound to it; also reflected in the computed secrets list. |
| aiAssistant | AiAssistant | Enable the AI assistant for this repository. Opt-in to Gemini-powered assistance (e.g. documenting pull requests and source code). See AiAssistant; pull request assistance activates only on private repositories. |
AiAssistant
AI-assistant configuration.
Groups the AI-assistant feature toggles for this repository. See AiAssistantPullRequest.
| Property | Type | Description |
|---|---|---|
| pullRequest | AiAssistantPullRequest | Pull request AI-assistant settings. See AiAssistantPullRequest. |
AiAssistantPullRequest
AI-assistant pull request settings.
Controls whether the AI assistant helps document pull requests for this repository.
| Property | Type | Description |
|---|---|---|
| enabled | bool | Enable AI assistance on pull requests. When true (and the repository is private), the engine wires up Gemini-based assistance for documenting pull requests. |
CodeOwnerEntry
Code-owner assignment for a repository path.
Associates a path pattern with the owners responsible for it; the collected entries generate the repository's .github/CODEOWNERS file.
| Property | Type | Description |
|---|---|---|
| path | string | Path pattern owned by the listed owners. A .github/CODEOWNERS path pattern (e.g. /docs or *.go). |
| owners | list of string | Owners for the path pattern. GitHub team slugs (or user handles) that own the matching paths; rendered as @owner/team entries scoped to the connection owner. |
Configuration
GitHub repository feature toggles.
Enables or disables optional built-in GitHub repository features.
| Property | Type | Description |
|---|---|---|
| wiki | bool | Enable the repository wiki. Maps to the repository's HasWiki attribute. |
| projects | bool | Enable GitHub Projects on the repository. Maps to the repository's HasProjects attribute. |
| issues | bool | Enable the repository issue tracker. Maps to the repository's HasIssues attribute. |
| downloads | bool | Enable repository downloads. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it); unlike wiki, projects, and issues, this toggle is not applied to the provisioned repository. |
PullRequestConfig
Pull request template selection.
References the GithubPullRequestTemplate used to seed this repository's pull request template. See the template field.
| Property | Type | Description |
|---|---|---|
| template | string | Name of the referenced GithubPullRequestTemplate manifest. Its Markdown content is resolved into this repository's computed pull_request_template. Validated only indirectly through computation (an unresolvable name yields empty content). |
AccessPermissions
Core definition for assigning administrative and viewer privileges across the platform.
Used by the engine to compute the final IAM policies (google_folder_iam_binding, etc.), aggregating individual user and group definitions to role assignments.
| Property | Type | Description |
|---|---|---|
| administrators | DetailedAccessPermissions | Administrators. Users and groups granted administrative privileges on the asset. Exact rights are resource-dependent but typically confer full control. See DetailedAccessPermissions. |
| contributors | DetailedAccessPermissions | Contributors. Users and groups granted contributor privileges on the asset. Exact rights are resource-dependent but typically confer read and write access. See DetailedAccessPermissions. |
| viewers | DetailedAccessPermissions | Viewers. Users and groups granted viewer privileges on the asset. Exact rights are resource-dependent but typically confer read-only access. See DetailedAccessPermissions. |
ComputedGithubBranchConfig
Represents computed branch protection rules for a GitHub repository.
Dictates the configuration applied to the github_branch_protection resource, enforcing review counts, status checks, and bypass roles.
| Property | Type | Description |
|---|---|---|
| id | string | The unique identifier for this set of rules (e.g., 'primary-branches', 'feature-branches'). |
| targetPatterns | list of string | A list of glob patterns for branches that these rules apply to (e.g., ['main', 'develop'] or ['feat/', 'bugfix/']). |
| requiredReviewers | int64 | The number of required approving reviews for a pull request before it can be merged. |
| canCreate | bool | Indicates whether branches matching these patterns can be created by users. |
| bypassRoles | list of string | A list of GitHub roles (e.g., 'Maintainer', 'Admin') who are allowed to bypass these rules. |
| statusChecks | list of string | A list of required status check contexts that must pass before merging. |
| releaseType | string | The type of release associated with this branch (e.g., 'major', 'minor', 'patch'), which can influence versioning automation. |
| allowedSourceBranchPatterns | list of string | A list of glob patterns for branches that are allowed to be merged into this branch (used by CI to enforce flow). |
| requiredBranchPattern | string | Optional regex pattern that branches matching the target_patterns must adhere to. |
| allowedMergeMethods | list of string | The merge methods (e.g. 'merge', 'squash', 'rebase') permitted when merging into these branches. |
DetailedAccessPermissions
Aggregation of specific user and group access definitions.
Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.
| Property | Type | Description |
|---|---|---|
| members | list of string | A list of 'OrganizationUser' manifest names to be included in this permission set. |
| groups | list of string | A list of 'OrganizationUserGroup' manifest names to be included in this permission set. |