diff --git a/CHANGELOG.md b/CHANGELOG.md index 30a1358..f3c24df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -36,6 +36,7 @@ To add an entry: ### Documentation +- **docs:** mark the Free-plan environment split in getting-started §2 as observed behavior and cite GitHub Docs (#124). The note claimed "deployment branch policies work on all plans" as bare fact; GitHub's availability notes actually state only that Free plans "can only configure environments for public repositories" with no per-feature breakdown, so the branch-policy half (REST accepted `deployment_branch_policy` on a Free private repo, 2026-07-16; required reviewers rejected with HTTP 422) is now labeled empirical, with the [Managing environments for deployment](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments) citation and its as-of date. Interim-posture guidance unchanged; `index.html` embeds regenerated. - **docs:** ADR 0057 — multi-environment support, the operator branch model (`main` upstream mirror / `dev` / `lab`), per-environment configuration by copying the lab files (no shipped `dev` scaffolds), and the ADR 0010 bounded federated-credential repository-migration cutover (add the new repo's subject, verify via `validate-oidc-auth` from the new repo, remove the old credential within the same change window; `New-AutomationEntraApp.ps1` intentionally keeps failing on >1 credential — the anomaly detection is preserved, not weakened) (#123). Rewrites the `copilot-instructions.md` "Environment and identifier boundaries" section for the two-environment contract (identifier rules unchanged); updates `github-actions.instructions.md` (environments, secrets, concurrency), `build-deploy.instructions.md` (per-environment `.bicepparam` selection), `getting-started.md` (Environment variables incl. `PURVIEW_RG` / `TENANT_DOMAIN` / `DATA_PLANE_CERT_NAME`, optional `dev` setup with `dev` / `kv-unlock-dev` federated subjects), and `tenant-onboarding.md` (optional multi-env step). Retires the `.github/workflows/**` tenant-surface entry in `tenant-placeholders.yaml` as an edit surface (literals moved to Environment variables) while keeping `functionalWorkflowScan` as the zero-match regression guard. ### Tests diff --git a/docs/getting-started.md b/docs/getting-started.md index 1978ce4..c6da5aa 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -98,7 +98,7 @@ Under **Settings → Secrets and variables → Actions**: Create the `lab` environment and the `kv-unlock` environment (Settings → Environments → New environment). The `kv-unlock` environment gates [`kv-temp-unlock.yml`](../.github/workflows/kv-temp-unlock.yml) independently and should carry its own required-reviewer protection rule per [ADR 0010 §3](adr/0010-automation-identity-subject-model.md). > [!NOTE] -> **GitHub plan prerequisite for required reviewers on private repos.** Deployment branch policies (pinning environment `lab` → branch `lab`) work on all plans. **Required reviewers** on Environment protection rules require GitHub **Pro**, **Team**, or **Enterprise** — on GitHub Free with a private repo, configuring required reviewers returns HTTP 422. Interim posture until plan upgrade: rely on deployment branch policy plus the per-environment OIDC subject as the two-layer guard ([ADR 0010 §3](adr/0010-automation-identity-subject-model.md)); the human-approval click before token mint is the piece lost on Free private repos. Public repos can use required reviewers on Free. +> **GitHub plan prerequisite for required reviewers on private repos.** Empirically (verified 2026-07-16 on a GitHub Free private repo): **deployment branch policies** (pinning environment `lab` → branch `lab`) can be configured via the REST API, while **required reviewers** on Environment protection rules are rejected with HTTP 422 — that layer requires GitHub **Pro**, **Team**, or **Enterprise**. Treat the branch-policy half as observed behavior, not a documented guarantee: the availability notes in [Managing environments for deployment](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments) state only that "Users with GitHub Free plans can only configure environments for public repositories" and that "Some features for environments have no or limited availability for private repositories", with no per-feature breakdown (as of 2026-07-16). Interim posture until plan upgrade: rely on deployment branch policy plus the per-environment OIDC subject as the two-layer guard ([ADR 0010 §3](adr/0010-automation-identity-subject-model.md)); the human-approval click before token mint is the piece lost on Free private repos. Public repos can use required reviewers on Free. ### Optional: add a `dev` environment (ADR 0057) diff --git a/index.html b/index.html index e4fef06..e347792 100644 --- a/index.html +++ b/index.html @@ -1024,7 +1024,7 @@

References

Create the `lab` environment and the `kv-unlock` environment (Settings → Environments → New environment). The `kv-unlock` environment gates [`kv-temp-unlock.yml`](../.github/workflows/kv-temp-unlock.yml) independently and should carry its own required-reviewer protection rule per [ADR 0010 §3](adr/0010-automation-identity-subject-model.md). > [!NOTE] -> **GitHub plan prerequisite for required reviewers on private repos.** Deployment branch policies (pinning environment `lab` → branch `lab`) work on all plans. **Required reviewers** on Environment protection rules require GitHub **Pro**, **Team**, or **Enterprise** — on GitHub Free with a private repo, configuring required reviewers returns HTTP 422. Interim posture until plan upgrade: rely on deployment branch policy plus the per-environment OIDC subject as the two-layer guard ([ADR 0010 §3](adr/0010-automation-identity-subject-model.md)); the human-approval click before token mint is the piece lost on Free private repos. Public repos can use required reviewers on Free. +> **GitHub plan prerequisite for required reviewers on private repos.** Empirically (verified 2026-07-16 on a GitHub Free private repo): **deployment branch policies** (pinning environment `lab` → branch `lab`) can be configured via the REST API, while **required reviewers** on Environment protection rules are rejected with HTTP 422 — that layer requires GitHub **Pro**, **Team**, or **Enterprise**. Treat the branch-policy half as observed behavior, not a documented guarantee: the availability notes in [Managing environments for deployment](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments) state only that "Users with GitHub Free plans can only configure environments for public repositories" and that "Some features for environments have no or limited availability for private repositories", with no per-feature breakdown (as of 2026-07-16). Interim posture until plan upgrade: rely on deployment branch policy plus the per-environment OIDC subject as the two-layer guard ([ADR 0010 §3](adr/0010-automation-identity-subject-model.md)); the human-approval click before token mint is the piece lost on Free private repos. Public repos can use required reviewers on Free. ### Optional: add a `dev` environment (ADR 0057)