feat(governance): Kravalg-gated multi-repo IAM/OIDC governance stack (#77)#78

Open

dmytrocraft wants to merge 39 commits into

codex/issue59-github-ci-bootstrap-stackfrom

feat/multi-repo-governance

Commits on Jun 13, 2026

feat(governance): repo-scoped Pulumi secrets alias conditions (E1.S1)

dmytrocraft
and
claude
committed
feat(governance): lift bootstrap role/policy helpers to a per-repo context

dmytrocraft
and
claude
committed
feat(governance): repo override + full secret-read Deny guardrails (E1.S3)

dmytrocraft
and
claude
committed
feat(governance): add RepoGovernance component + governance apply-subject override

dmytrocraft
and
claude
committed
feat(governance): GovernanceStack loop + OIDC-by-ARN + account assertion

dmytrocraft
and
claude
committed
docs(governance): BMAD planning artifacts for issue #77 (multi-repo IAM/OIDC governance)

dmytrocraft
and
claude
committed
feat(governance): scaffold pulumi/governance project (two-account test/prod)

dmytrocraft
and
claude
committed
feat(governance): add governance catalog + shared path-glob source of truth

dmytrocraft
and
claude
committed
feat(governance): per-catalog-kind fanout + project/role-name guards

dmytrocraft
and
claude
committed
test(governance): scope mock-resource scans to each test's own component

dmytrocraft
and
claude
committed
fix(wa-evidence): exclude governance catalog from deployment-fanout evidence

dmytrocraft
and
claude
committed
feat(governance): add Kravalg CODEOWNERS for §7.1 governance scope

dmytrocraft
and
claude
committed
feat(governance): protected governance environment payload + verify, harden PR rule

dmytrocraft
and
claude
committed
feat(governance): add dedicated env-gated governance runner workflow

dmytrocraft
and
claude
committed
feat(governance): register Governance Apply required check bound to runner status-post

dmytrocraft
and
claude
committed
feat(governance): path-aware @Kravalg author gate in pulumi_pr_comment

dmytrocraft
and
claude
committed
feat(governance): route governance PR commands at intake

dmytrocraft
and
claude
committed
feat(governance): guard PR command runner event + ordering graph

dmytrocraft
and
claude
committed
feat(governance): scaffold user-service-infrastructure template assets

dmytrocraft
and
claude
committed
feat(governance): self-deploy template for user-service-infrastructure

dmytrocraft
and
claude
committed
fix(governance): close missing-glob privilege holes in apply scope

dmytrocraft
and
claude
committed
fix(governance): always-reportable Governance Apply required check (B1)

dmytrocraft
and
claude
committed
fix(governance): terminal Governance Apply status lifecycle in runner (B2)

dmytrocraft
and
claude
committed
docs(governance): clarify intake gate is advisory; runner recompute is authoritative (C)

dmytrocraft
and
claude
committed
docs(governance): add multi-repo onboarding flow to AGENTS.md

dmytrocraft
and
claude
committed
docs(governance): add governance-stack design + operator runbook

dmytrocraft
and
claude
committed
test(governance): cover defensive branches to 100% unit coverage

dmytrocraft
and
claude
committed
test(governance): isolate infra.governance from policy/app/scripts

dmytrocraft
and
claude
committed
test(governance): sync quality-contracts pin with infra root package + governance contract

dmytrocraft
and
claude
committed
fix(governance): drop Governance Apply from required status checks

dmytrocraft
and
claude
committed
fix(governance): remove unneeded pull_request_target status setter

dmytrocraft
and
claude
committed
docs(governance): Governance Apply is informational, revert count to 24

dmytrocraft
and
claude
committed
fix(governance): drop kms:Decrypt from read-only Deny so preview/drift decrypt

dmytrocraft
and
claude
committed
fix(governance): guard catalog role names against the real rendered length

dmytrocraft
and
claude
committed
fix(governance): default managed-repo PULUMI_DIR to the repo-root project

dmytrocraft
and
claude
committed
fix(governance): prod payload parity, drop unused arg, annotate return

dmytrocraft
and
claude
committed
docs(governance): drop redundant PULUMI_SECRETS_PROVIDER env from runbook

dmytrocraft
and
claude
committed
fix(governance): honor command/target in runner and fix the apply trust path

dmytrocraft
and
claude
committed
fix(governance): make longest-role-name reduction explicitly str-typed

dmytrocraft
and
claude
committed